CVE-2023-22814 : An authentication bypass issue via spoofing was discovered in the token-based au

An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before 5.26.202.

Published 2023-07-01 00:15:10

Updated 2023-07-10 15:25:29

Source Western Digital

View at NVD, CVE.org

Products affected by CVE-2023-22814

Westerndigital » My Cloud Os
Versions from including (>=) 5.02.104 and before (<) 5.26.202
cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Westerndigital » My Cloud » Version: N/A
When used together with: Westerndigital » My Cloud Dl2100 » Version: N/A
When used together with: Westerndigital » My Cloud Dl4100 » Version: N/A
When used together with: Westerndigital » My Cloud Ex2 Ultra » Version: N/A
When used together with: Westerndigital » My Cloud Ex2100 » Version: N/A
When used together with: Westerndigital » My Cloud Ex4100 » Version: N/A
When used together with: Westerndigital » My Cloud Mirror G2 » Version: N/A
When used together with: Westerndigital » My Cloud Pr2100 » Version: N/A
When used together with: Westerndigital » My Cloud Pr4100 » Version: N/A
When used together with: Westerndigital » Wd Cloud » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-22814

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 62 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-22814

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H	3.9	5.8	Western Digital
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: High Availability: High

CWE ids for CVE-2023-22814

CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Assigned by:
- nvd@nist.gov (Primary)
- psirt@wdc.com (Secondary)

References for CVE-2023-22814

https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202

WDC-23006 My Cloud Firmware Version 5.26.202 | Western Digital
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-22814

Products affected by CVE-2023-22814

Exploit prediction scoring system (EPSS) score for CVE-2023-22814

CVSS scores for CVE-2023-22814

CWE ids for CVE-2023-22814

References for CVE-2023-22814