CVE-2022-22993

Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.

HIGH

8.8

CVSS Score

Published: January 28, 2022 at 07:09 PM UTC

Updated: June 17, 2026 at 04:29 AM UTC

11 products affected across 1 vendorMy Cloud OSMy Cloud PR4100My Cloud EX4100

Using My Cloud by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.8%

Description

A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud OS · Westerndigital

95%

v < 5.19.117

Affected range stops below 5.19.117, so it looks safe — our inference, not a vendor statement

westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device) · westerndigital-my-cloud-dl2100 (same device) · westerndigital-my-cloud-dl4100 (same device) · westerndigital-my-cloud-ex2-ultra (same device) · westerndigital-my-cloud-ex2100 (same device) · westerndigital-my-cloud-ex4100 (same device) · westerndigital-my-cloud-mirror-gen-2 (same device) · westerndigital-my-cloud-pr2100 (same device) · westerndigital-my-cloud-pr4100 (same device)

My Cloud · Westerndigital

60%

My Cloud OS 5 ≤ v < 5.19.117My Cloud OS 5

Affected range stops below 5.19.117, so it looks safe — our inference, not a vendor statement

My Cloud DL2100 · Westerndigitaldevice

80%

All versions

My Cloud DL4100 · Westerndigitaldevice

80%

All versions

My Cloud EX2 Ultra · Westerndigitaldevice

80%