CVE-2022-22991

Name of the Vulnerable Software and Affected Versions Western Digital MyCloud PR4100 (affected versions not specified)

Description A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. The issue was addressed by disabling checks for internet connectivity using HTTP.

Recommendations To resolve the issue, disable checks for internet connectivity using HTTP. At the moment, there is no information about a newer version that contains a fix for this vulnerability.