What’s Vulnerable › Vulnerabilities

CVE-2022-22997: Command Injection Vulnerability on My Cloud Home

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-12 · updated 2026-06-17
• Weakness: CWE-78

Description

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.

Affected products

• Westerndigital My Cloud Home Duo Firmware: before 8.5.1-102 — fixed in 8.5.1-102
• Westerndigital My Cloud Home Firmware: before 8.5.1-102 — fixed in 8.5.1-102

How to fix

Upgrade to a fixed version: Westerndigital My Cloud Home Duo Firmware 8.5.1-102; Westerndigital My Cloud Home Firmware 8.5.1-102. Check the vendor advisory for mitigations.

References

• https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107
• https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107

Get alerted when CVE-2022-22997 or the next vulnerability affects your stack