Cyber Resilience

CVE-2022-29843

Medium

Published: 26 January 2023

Published
26 January 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0072 72.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-29843 is a medium-severity OS Command Injection (CWE-78) vulnerability in Westerndigital My Cloud Pr2100 Firmware. Its CVSS base score is 6.2 (Medium).

Operationally, ranked in the top 27.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

westerndigital
my cloud pr2100 firmware
≤ 5.26.119
westerndigital
my cloud pr4100 firmware
≤ 5.26.119
westerndigital
my cloud ex4100 firmware
≤ 5.26.119
westerndigital
my cloud ex2 ultra firmware
≤ 5.26.119
westerndigital
my cloud mirror g2 firmware
≤ 5.26.119
westerndigital
my cloud dl2100 firmware
≤ 5.26.119
westerndigital
my cloud dl4100 firmware
≤ 5.26.119
westerndigital
my cloud ex2100 firmware
≤ 5.26.119

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References