Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.

published 2022-01-28 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-28103

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.3%; EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits: 0; none known

A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.

Patch / fix

fixed in 1

westerndigital my_cloud_os 5.19.117

Exploit prediction

2.31% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-116 Improper Encoding or Escaping of Output

References

westerndigital.com /support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
vendor-advisory

Sources

CVE List CVE-2022-22992
NVD CVE-2022-22992

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary