CVE-2022-22998: Protecting AWS credentials stored in plaintext on My Cloud Home

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-12 · updated 2026-06-17
Weakness: CWE-522

Description

Implemented protections on AWS credentials that were not properly protected.

Affected products

Westerndigital My Cloud Home Duo Firmware: before 8.5.1-102 — fixed in 8.5.1-102
Westerndigital My Cloud Home Firmware: before 8.5.1-102 — fixed in 8.5.1-102

How to fix

Upgrade to a fixed version: Westerndigital My Cloud Home Duo Firmware 8.5.1-102; Westerndigital My Cloud Home Firmware 8.5.1-102. Check the vendor advisory for mitigations.

References

https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107
https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107

Get alerted when CVE-2022-22998 or the next vulnerability affects your stack