What’s Vulnerable › Vulnerabilities

CVE-2022-29835: WD Discovery's Use of Weak Hashing Algorithm for Code Signing

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-19 · updated 2026-06-17
• Weakness: CWE-328

Description

WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows.

Affected products

• Western Digital WD Discovery: before 4.4.396 — fixed in 4.4.396

How to fix

Upgrade to a fixed version: Western Digital WD Discovery 4.4.396. Check the vendor advisory for mitigations.

References

• https://www.westerndigital.com/support/product-security/wdc-22014-wd-discovery-desktop-app-version-4-4-396
• https://www.westerndigital.com/support/product-security/wdc-22014-wd-discovery-desktop-app-version-4-4-396

Get alerted when CVE-2022-29835 or the next vulnerability affects your stack