CVE-2022-22997: Westerndigital My Cloud Home Duo Firmware

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.

Affected products

• Westerndigital My Cloud Home Duo Firmware: before 8.5.1-102 (fixed in 8.5.1-102)
• Westerndigital My Cloud Home Firmware: before 8.5.1-102 (fixed in 8.5.1-102)

Published 2022-07-12. Last modified 2026-06-17.