Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2022-29841 Details

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location and created a system command without sanitizing the read data. This command could be triggered by an attacker remotely to cause code execution and gain a reverse shell in Western Digital My Cloud OS 5 devices.This issue affects My Cloud OS 5: before 5.26.119.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:8 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119	CVE	Vendor Advisory
https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	[email protected]
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	[email protected]

Affected Products

Product	Versions
westerndigital my cloud os	>= 5.02.104, < 5.26.119
CPE cpe:2.3:o:westerndigital:my_cloud_os:::::::: Remediation No remediation found in references.
westerndigital my cloud	All versions
CPE cpe:2.3:h:westerndigital:my_cloud:-:::::::* Remediation No remediation found in references.
westerndigital my cloud dl2100	All versions
CPE cpe:2.3:h:westerndigital:my_cloud_dl2100:-:::::::* Remediation No remediation found in references.
westerndigital my cloud dl4100	All versions
CPE cpe:2.3:h:westerndigital:my_cloud_dl4100:-:::::::* Remediation No remediation found in references.
westerndigital my cloud ex2 ultra	All versions
CPE cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:::::::* Remediation No remediation found in references.
westerndigital my cloud ex2100	All versions
CPE cpe:2.3:h:westerndigital:my_cloud_ex2100:-:::::::* Remediation No remediation found in references.
westerndigital my cloud ex4100	All versions
CPE cpe:2.3:h:westerndigital:my_cloud_ex4100:-:::::::* Remediation No remediation found in references.
westerndigital my cloud mirror g2	All versions
CPE cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:::::::* Remediation No remediation found in references.
westerndigital my cloud pr2100	All versions
CPE cpe:2.3:h:westerndigital:my_cloud_pr2100:-:::::::* Remediation No remediation found in references.
westerndigital my cloud pr4100	All versions
CPE cpe:2.3:h:westerndigital:my_cloud_pr4100:-:::::::* Remediation No remediation found in references.
westerndigital wd cloud	All versions
CPE cpe:2.3:h:westerndigital:wd_cloud:-:::::::* Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
May 22, 2023	Initial Analysis	[email protected]

CVE-2022-29841 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO