CVE-2022-29838: Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-09 · updated 2026-06-17
Weakness: CWE-287

Description

Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

Affected products

Western Digital My Cloud: before 5.25.124 — fixed in 5.25.124

How to fix

Upgrade to a fixed version: Western Digital My Cloud 5.25.124. Check the vendor advisory for mitigations.

References

https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124

Get alerted when CVE-2022-29838 or the next vulnerability affects your stack