Westerndigital Wd Discovery vulnerabilities

4 CVEs affecting Westerndigital Wd Discovery, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-22169, published 2024-08-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-15816, published 2020-07-17. High severity, CVSS 8.8. EPSS: 4.1% chance of exploitation in the next 30 days. In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection…
CVE-2020-12427, published 2020-05-13. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting…
CVE-2024-22169, published 2024-08-02. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any…
CVE-2022-29835, published 2022-09-19. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing…