What’s Vulnerable › Vulnerabilities

CVE-2023-22815: Post-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devices

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-30 · updated 2026-06-17
• Weakness: CWE-78

Description

Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network and the attacker must already have admin/root privileges to carry out the exploit. An authentication bypass is required for this exploit, thereby making it more complex. The attack may not require user interaction. Since an attacker must already be authenticated, the confidentiality impact is low while the integrity and availability impact is high.  This issue affects My Cloud OS 5 devices: before 5.26.300.

Affected products

• Western Digital My Cloud: before 5.26.300 — fixed in 5.26.300

How to fix

Upgrade to a fixed version: Western Digital My Cloud 5.26.300. Check the vendor advisory for mitigations.

References

• https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300
• https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300

Get alerted when CVE-2023-22815 or the next vulnerability affects your stack