CVE-2022-29838 : Improper Authentication vulnerability in the encrypted volumes and auto mount fe

Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

Published 2022-12-09 18:15:19

Updated 2022-12-12 17:45:14

Source Western Digital

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2022-29838

Westerndigital » My Cloud Os
Versions before (<) 5.25.124
cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Westerndigital » My Cloud » Version: N/A
When used together with: Westerndigital » My Cloud Dl2100 » Version: N/A
When used together with: Westerndigital » My Cloud Dl4100 » Version: N/A
When used together with: Westerndigital » My Cloud Ex2 Ultra » Version: N/A
When used together with: Westerndigital » My Cloud Ex2100 » Version: N/A
When used together with: Westerndigital » My Cloud Ex4100 » Version: N/A
When used together with: Westerndigital » My Cloud Mirror G2 » Version: N/A
When used together with: Westerndigital » My Cloud Pr2100 » Version: N/A
When used together with: Westerndigital » My Cloud Pr4100 » Version: N/A
When used together with: Westerndigital » Wd Cloud » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-29838

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-29838

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	0.9	3.6	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	0.7	3.6	Western Digital
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-29838

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Assigned by:
- nvd@nist.gov (Primary)
- psirt@wdc.com (Secondary)

References for CVE-2022-29838

https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124

WDC-22019 My Cloud Firmware Version 5.25.124 | Western Digital
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-29838

Products affected by CVE-2022-29838

Exploit prediction scoring system (EPSS) score for CVE-2022-29838

CVSS scores for CVE-2022-29838

CWE ids for CVE-2022-29838

References for CVE-2022-29838