CVE-2022-29838

Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices

MEDIUM

4.6

CVSS Score

Published: December 9, 2022 at 12:00 AM UTC

Updated: June 17, 2026 at 04:40 AM UTC

11 products affected across 1 vendorMy Cloud OSMy Cloud PR4100My Cloud EX4100

Using My Cloud by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.6

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud OS · Westerndigital

95%

v < 5.25.124

Affected range stops below 5.25.124, so it looks safe — our inference, not a vendor statement

westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device) · westerndigital-my-cloud-dl2100 (same device) · westerndigital-my-cloud-dl4100 (same device) · westerndigital-my-cloud-ex2-ultra (same device) · westerndigital-my-cloud-ex2100 (same device) · westerndigital-my-cloud-ex4100 (same device) · westerndigital-my-cloud-mirror-g2 (same device) · westerndigital-my-cloud-pr2100 (same device) · westerndigital-my-cloud-pr4100 (same device)

My Cloud · Westerndigital

60%

My Cloud ≤ v < 5.25.124

Affected range stops below 5.25.124, so it looks safe — our inference, not a vendor statement

My Cloud DL2100 · Westerndigitaldevice

80%

All versions

My Cloud DL4100 · Westerndigitaldevice

80%

All versions

My Cloud EX2 Ultra · Westerndigitaldevice

80%