#VU69918 Improper Authentication in Western Digital products - CVE-2022-29838
Published: December 6, 2022
Vulnerability identifier: #VU69918
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-29838
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
My Cloud OS 5
My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
My Cloud OS 5
Software vendor:
Western Digital
Western Digital
Description
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper authentication within the encrypted volumes and auto mount feature. A remote attacker can gain a direct access to the drive information in the case of a device reset.
Remediation
Install updates from vendor's website.