Known vulnerabilities in WD My Cloud

Known vulnerabilities in WD My Cloud

Vendor: Western Digital

Software: WD My Cloud

Software CPE: cpe:2.3:h:western_digital:wd_my_cloud:*:*:*:*:*:*:*:*

Website: https://www.wdc.com/

Total vulnerabilities: 16

Public exploits: 3

Known exploited (KEV): 2

Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Vulnerabilities (16)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU60714 - Insufficient Verification of Data Authenticity CVE-2022-22994	CWE-345	Medium	No	No	-	18.02.2022	SB2022021810
#VU60713 - Command injection CVE-2022-22991	CWE-77	Medium	No	No	-	18.02.2022	SB2022021810
#VU60712 - Stack-based buffer overflow CVE-2022-22989	CWE-121	Medium	No	No	-	18.02.2022	SB2022021810
#VU60711 - Command injection CVE-2022-22992	CWE-77	High	No	No	-	18.02.2022	SB2022021810
#VU60710 - Improper Authentication CVE-2022-22990	CWE-287	Low	No	No	-	18.02.2022	SB2022021810
#VU60709 - Server-Side Request Forgery (SSRF) CVE-2022-22993	CWE-918	Low	No	No	-	18.02.2022	SB2022021810
#VU55402 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	CWE-79	Low	No	No	-	28.07.2021	SB2021072808
#VU10163 - Improper Authentication CVE-2017-17560	CWE-287	High	Available	No	-	23.01.2018	SB2018012311
#VU9874 - Improper Access Control	CWE-284	Medium	No	No	-	08.01.2018	SB2017120506
#VU9873 - Cross-Site Request Forgery (CSRF)	CWE-352	Medium	No	No	-	08.01.2018	SB2017120506
#VU9872 - Unrestricted Upload of File with Dangerous Type	CWE-434	High	No	No	-	08.01.2018	SB2017120506
#VU9871 - Hidden Functionality (Backdoor)	CWE-912	Critical	No	Exploited	-	08.01.2018	SB2017120506 SB2018010805
#VU6676 - Untrusted Search Path CVE-2017-7494	CWE-426	Medium	Available	Exploited	-	24.05.2017	SB2017052410 SB2017052413 SB2017052414 and 20 more
#VU3125 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVE-2016-10107	CWE-78	High	No	No	-	03.01.2017	SB2017010305
#VU3124 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVE-2016-10108	CWE-78	High	Available	No	-	03.01.2017	SB2017010305
#VU41342 - Cryptographic Issues CVE-2014-5876	CWE-310	Medium	No	No	-	11.09.2014	SB2014091106