CVE-2022-22990

Limited authentication bypass vulnerability on Western Digital My Cloud devices

HIGH

8.8

CVSS Score

Published: January 13, 2022 at 08:27 PM UTC

Updated: June 17, 2026 at 04:29 AM UTC

11 products affected across 1 vendorMy Cloud OSMy Cloud PR4100My Cloud EX4100

Using My Cloud by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 2%

Description

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud OS · Westerndigital

95%

v < 5.19.117

Affected range stops below 5.19.117, so it looks safe — our inference, not a vendor statement

westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device) · westerndigital-my-cloud-dl2100 (same device) · westerndigital-my-cloud-dl4100 (same device) · westerndigital-my-cloud-ex2-ultra (same device) · westerndigital-my-cloud-ex2100 (same device) · westerndigital-my-cloud-ex4100 (same device) · westerndigital-my-cloud-mirror-gen-2 (same device) · westerndigital-my-cloud-pr2100 (same device) · westerndigital-my-cloud-pr4100 (same device)

My Cloud · Westerndigital

60%

My Cloud OS 5 ≤ v < 5.19.117My Cloud OS 5

Affected range stops below 5.19.117, so it looks safe — our inference, not a vendor statement

My Cloud DL2100 · Westerndigitaldevice

80%

All versions

My Cloud DL4100 · Westerndigitaldevice

80%

All versions

My Cloud EX2 Ultra · Westerndigitaldevice

80%