CVE-2022-22991: Westerndigital My Cloud OS

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.

Affected products

• Westerndigital My Cloud OS: before 5.19.117 (fixed in 5.19.117)

Published 2022-01-13. Last modified 2026-06-17.