CVE-2022-29839: Remote Backups Application Discloses Stored Credentials

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-09 · updated 2026-06-17
Weakness: CWE-522

Description

Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

Affected products

Western Digital My Cloud: before 5.25.124 — fixed in 5.25.124

How to fix

Upgrade to a fixed version: Western Digital My Cloud 5.25.124. Check the vendor advisory for mitigations.

References

https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124

Get alerted when CVE-2022-29839 or the next vulnerability affects your stack