PT-2023-12987

CVE-2022-29842

Published

2023-05-10

Updated

2023-06-08

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud OS 5 versions prior to 5.26.119

Description An issue was discovered in Western Digital My Cloud OS 5 devices, allowing an attacker to execute code in the context of the root user on a vulnerable CGI file due to improper neutralization of special elements used in a command. This issue could lead to remote code execution.

Recommendations For versions prior to 5.26.119, update to version 5.26.119 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable CGI file until a patch is applied.

Exploitability

Fix

Impacts

Researchers

S_N_T

Sam Thomas

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers

CVE-2022-29842