CVE-2023-22815

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22815
Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network and the attacker must already have admin/root privileges to carry out the exploit. An authentication bypass is required for this exploit, thereby making it more complex. The attack may not require user interaction. Since an attacker must already be authenticated, the confidentiality impact is low while the integrity and availability impact is high.  This issue affects My Cloud OS 5 devices: before 5.26.300.

6.2 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300 Vendor Advisory
https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:*
OR cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:45

Type Values Removed Values Added
References () https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300 - Vendor Advisory () https://www.westerndigital.com/support/product-security/wdc-23010-my-cloud-firmware-version-5-26-300 - Vendor Advisory
CVSS v2 : unknown
v3 : 6.7 		v2 : unknown
v3 : 6.2

05 Sep 2024, 23:15

Type Values Removed Values Added
CWE CWE-78
Summary (en) Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network and the attacker must already have admin/root privileges to carry out the exploit. An authentication bypass is required for this exploit, thereby making it more complex. The attack may not require user interaction. Since an attacker must already be authenticated, the confidentiality impact is low while the integrity and availability impact is high.  This issue affects My Cloud OS 5 devices: before 5.26.300. (en) Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network and the attacker must already have admin/root privileges to carry out the exploit. An authentication bypass is required for this exploit, thereby making it more complex. The attack may not require user interaction. Since an attacker must already be authenticated, the confidentiality impact is low while the integrity and availability impact is high.  This issue affects My Cloud OS 5 devices: before 5.26.300.
Information

Published : 2023-06-30 22:15

Updated : 2024-11-21 07:45

NVD link : CVE-2023-22815

Mitre link : CVE-2023-22815

CVE.ORG link : CVE-2023-22815

JSON object : View

Products Affected

westerndigital

  • wd_cloud
  • my_cloud
  • my_cloud_pr2100
  • my_cloud_ex2_ultra
  • my_cloud_ex4100
  • my_cloud_os
  • my_cloud_mirror_g2
  • my_cloud_ex2100
  • my_cloud_dl4100
  • my_cloud_pr4100
  • my_cloud_dl2100
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')