CVE-2022-22993: Westerndigital My Cloud OS

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.

Affected products

• Westerndigital My Cloud OS: before 5.19.117 (fixed in 5.19.117)

Published 2022-01-28. Last modified 2026-06-17.