CVE-2022-22988: Insecure file and directory permissions on EdgeRover

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-13 · updated 2026-06-17
Weakness: CWE-275

Description

File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to get authenticated access to the device.

Affected products

Western Digital EdgeRover: before 1.5.0-576 — fixed in 1.5.0-576

How to fix

Upgrade to a fixed version: Western Digital EdgeRover 1.5.0-576. Check the vendor advisory for mitigations.

References

https://www.westerndigital.com/support/product-security/wdc-22003-edgerover-desktop-app-version-1-5-0-576
https://www.westerndigital.com/support/product-security/wdc-22003-edgerover-desktop-app-version-1-5-0-576

Get alerted when CVE-2022-22988 or the next vulnerability affects your stack