CVE-2022-29839

Remote Backups Application Discloses Stored Credentials

MEDIUM

5.5

CVSS Score

Published: December 9, 2022 at 12:00 AM UTC

Updated: June 17, 2026 at 04:40 AM UTC

11 products affected across 1 vendorMy Cloud OSMy Cloud PR4100My Cloud EX4100· also runs on 1 platform

Using My Cloud by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

SSVC

No known exploit

Description

Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud OS · Westerndigital

95%

v < 5.25.124

Affected range stops below 5.25.124, so it looks safe — our inference, not a vendor statement

linux-linux-kernel (environment) · westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device) · westerndigital-my-cloud-dl2100 (same device) · westerndigital-my-cloud-dl4100 (same device) · westerndigital-my-cloud-ex2-ultra (same device) · westerndigital-my-cloud-ex2100 (same device) · westerndigital-my-cloud-ex4100 (same device) · westerndigital-my-cloud-mirror-g2 (same device) · westerndigital-my-cloud-pr2100 (same device) · westerndigital-my-cloud-pr4100 (same device)

My Cloud · Westerndigital

60%

My Cloud ≤ v < 5.25.124

Affected range stops below 5.25.124, so it looks safe — our inference, not a vendor statement

My Cloud DL2100 · Westerndigitaldevice

80%

All versions

My Cloud DL4100 · Westerndigitaldevice

80%

All versions

My Cloud EX2 Ultra · Westerndigitaldevice

80%