What’s Vulnerable › Products

Western Digital My Cloud vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your Western Digital My Cloud version is affected

Latest Western Digital My Cloud vulnerabilities

• CVE-2025-30247 — (CVSS 9.3)
• CVE-2023-22814 — Authentication Bypass issue in My Cloud OS 5 devices (CVSS 9.8)
• CVE-2023-22816 — Limited Post-Authentication Remote Command Injection in My Cloud Products (CVSS 8.8)
• CVE-2023-22815 — Post-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devices (CVSS 6.7)
• CVE-2022-29840 — Server Side Request Forgery Vulnerability in Western Digital My Cloud Devices (CVSS 5.5)
• CVE-2022-29841 — OS Command Injection vulnerability in Western Digital My Cloud devices (CVSS 9.8)
• CVE-2022-29842 — Command Injection Vulnerability in Western Digital My Cloud devices (CVSS 9.8)
• CVE-2021-36226 — (CVSS 9.8)
• CVE-2021-36225 — (CVSS 8.8)
• CVE-2021-36224 — (CVSS 9.8)
• CVE-2022-29839 — Remote Backups Application Discloses Stored Credentials (CVSS 5.5)
• CVE-2022-29838 — Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices (CVSS 4.6)
• CVE-2022-22994 — Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices. (CVSS 9.8)
• CVE-2022-22993 — Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices. (CVSS 8.8)
• CVE-2022-22992 — Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices. (CVSS 9.8)
• CVE-2022-22991 — Command injection through unsecured HTTP calls on Western Digital My Cloud devices (CVSS 8.8)
• CVE-2022-22990 — Limited authentication bypass vulnerability on Western Digital My Cloud devices (CVSS 8.8)
• CVE-2022-22989 — Pre-authenticated stack overflow vulnerability on FTP Service (CVSS 9.8)
• CVE-2021-3310 — (CVSS 7.8)