CVE-2022-29843

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud OS versions prior to 5.26.119

Description A command injection issue in the DDNS service configuration allows an attacker to execute code as the root user. This issue was demonstrated at Pwn2Own, indicating its potential for real-world exploitation.

Recommendations For versions prior to 5.26.119, update the firmware to version 5.26.119 or later to resolve the issue. As a temporary workaround, consider restricting access to the DDNS service configuration to minimize the risk of exploitation.