CVE-2022-22989: Westerndigital My Cloud OS

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues.

Affected products

• Westerndigital My Cloud OS: before 5.19.117 (fixed in 5.19.117)

Published 2022-01-13. Last modified 2026-06-17.