Sign-up

ID

VAR-202201-0613


CVE

CVE-2022-22991


TITLE

My Cloud OS 5  Command injection vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2022-003514

DESCRIPTION

A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP. My Cloud OS 5 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability.The specific flaw exists within the ConnectivityService service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Western Digital My Cloud is a personal cloud storage device from Western Digital

Trust: 2.88

sources: NVD: CVE-2022-22991 // JVNDB: JVNDB-2022-003514 // ZDI: ZDI-22-077 // CNVD: CNVD-2022-06494 // VULMON: CVE-2022-22991

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-06494

AFFECTED PRODUCTS

vendor:westerndigitalmodel:my cloud osscope:ltversion:5.19.117

Trust: 1.0

vendor:western digitalmodel:my cloud os 5scope:eqversion: -

Trust: 0.8

vendor:western digitalmodel:my cloud os 5scope: - version: -

Trust: 0.8

vendor:western digitalmodel:my cloud os 5scope:eqversion:my cloud os 5 firmware

Trust: 0.8

vendor:western digitalmodel:mycloud pr4100scope: - version: -

Trust: 0.7

vendor:westernmodel:digital my cloud osscope:eqversion:5

Trust: 0.6

sources: ZDI: ZDI-22-077 // CNVD: CNVD-2022-06494 // JVNDB: JVNDB-2022-003514 // NVD: CVE-2022-22991

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-22991
value: HIGH

Trust: 1.0

psirt@wdc.com: CVE-2022-22991
value: HIGH

Trust: 1.0

NVD: CVE-2022-22991
value: HIGH

Trust: 0.8

ZDI: CVE-2022-22991
value: HIGH

Trust: 0.7

CNVD: CNVD-2022-06494
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202201-1069
value: HIGH

Trust: 0.6

VULMON: CVE-2022-22991
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-22991
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-06494
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-22991
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

psirt@wdc.com: CVE-2022-22991
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.4
impactScore: 5.8
version: 3.1

Trust: 1.0

NVD: CVE-2022-22991
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-22991
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-077 // CNVD: CNVD-2022-06494 // VULMON: CVE-2022-22991 // JVNDB: JVNDB-2022-003514 // CNNVD: CNNVD-202201-1069 // NVD: CVE-2022-22991 // NVD: CVE-2022-22991

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:CWE-77

Trust: 1.0

problemtype:Command injection (CWE-77) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-003514 // NVD: CVE-2022-22991

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202201-1069

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202201-1069

PATCH

title:WDC-22002url:https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117

Trust: 1.5

title:Patch for Western Digital My Cloud OS 5 Command Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/315881

Trust: 0.6

title:Western Digital My Cloud Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=178298

Trust: 0.6

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: ZDI: ZDI-22-077 // CNVD: CNVD-2022-06494 // VULMON: CVE-2022-22991 // JVNDB: JVNDB-2022-003514 // CNNVD: CNNVD-202201-1069

EXTERNAL IDS

db:NVDid:CVE-2022-22991

Trust: 4.6

db:ZDIid:ZDI-22-077

Trust: 3.2

db:JVNDBid:JVNDB-2022-003514

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15856

Trust: 0.7

db:CNVDid:CNVD-2022-06494

Trust: 0.6

db:CS-HELPid:SB2022021810

Trust: 0.6

db:CNNVDid:CNNVD-202201-1069

Trust: 0.6

db:VULMONid:CVE-2022-22991

Trust: 0.1

sources: ZDI: ZDI-22-077 // CNVD: CNVD-2022-06494 // VULMON: CVE-2022-22991 // JVNDB: JVNDB-2022-003514 // CNNVD: CNNVD-202201-1069 // NVD: CVE-2022-22991

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-077/

Trust: 3.2

url:https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117

Trust: 3.0

url:https://nvd.nist.gov/vuln/detail/cve-2022-22991

Trust: 1.4

url:https://www.cybersecurity-help.cz/vdb/sb2022021810

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/77.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

sources: ZDI: ZDI-22-077 // CNVD: CNVD-2022-06494 // VULMON: CVE-2022-22991 // JVNDB: JVNDB-2022-003514 // CNNVD: CNNVD-202201-1069 // NVD: CVE-2022-22991

CREDITS

Martin Rakhmanov (@mrakhmanov)

Trust: 0.7

sources: ZDI: ZDI-22-077

SOURCES

db:ZDIid:ZDI-22-077
db:CNVDid:CNVD-2022-06494
db:VULMONid:CVE-2022-22991
db:JVNDBid:JVNDB-2022-003514
db:CNNVDid:CNNVD-202201-1069
db:NVDid:CVE-2022-22991

LAST UPDATE DATE

2024-11-23T22:44:06.568000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-077date:2022-01-18T00:00:00
db:CNVDid:CNVD-2022-06494date:2022-01-25T00:00:00
db:VULMONid:CVE-2022-22991date:2022-01-21T00:00:00
db:JVNDBid:JVNDB-2022-003514date:2023-02-22T05:41:00
db:CNNVDid:CNNVD-202201-1069date:2022-02-28T00:00:00
db:NVDid:CVE-2022-22991date:2024-11-21T06:47:45.503

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-077date:2022-01-17T00:00:00
db:CNVDid:CNVD-2022-06494date:2022-01-25T00:00:00
db:VULMONid:CVE-2022-22991date:2022-01-13T00:00:00
db:JVNDBid:JVNDB-2022-003514date:2023-02-22T00:00:00
db:CNNVDid:CNNVD-202201-1069date:2022-01-13T00:00:00
db:NVDid:CVE-2022-22991date:2022-01-13T21:15:08.980