Westerndigital My Cloud OS 5 vulnerabilities

8 CVEs affecting Westerndigital My Cloud OS 5, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-36328, published 2023-05-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-28970, published 2020-12-01. Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days. An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on…
CVE-2020-28940, published 2020-12-01. Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days. On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticated user to execute privileged commands on…
CVE-2020-28971, published 2020-12-01. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on…
CVE-2020-29563, published 2020-12-12. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device.
CVE-2022-36327, published 2023-05-18. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to…
CVE-2022-36328, published 2023-05-18. Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive…
CVE-2022-36326, published 2023-05-18. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being…
CVE-2023-22813, published 2023-05-08. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile…