CVE-2022-29840

Server Side Request Forgery Vulnerability in Western Digital My Cloud Devices

MEDIUM

5.5

CVSS Score

Published: May 10, 2023 at 10:09 PM UTC

Updated: June 17, 2026 at 04:40 AM UTC

12 products affected across 1 vendorMy Cloud OSMy Cloud PR4100My Cloud EX4100

Using My Cloud OS 5 by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud OS 5 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

SSVC

No known exploit

Description

Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This issue affects My Cloud OS 5 devices before 5.26.202.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud OS · Westerndigital

95%

5.02.104 ≤ v < 5.26.202

Affected range stops below 5.26.202, so it looks safe — our inference, not a vendor statement

westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device) · westerndigital-my-cloud-dl2100 (same device) · westerndigital-my-cloud-dl4100 (same device) · westerndigital-my-cloud-ex2-ultra (same device) · westerndigital-my-cloud-ex2100 (same device) · westerndigital-my-cloud-ex4100 (same device) · westerndigital-my-cloud-mirror-g2 (same device) · westerndigital-my-cloud-pr2100 (same device) · westerndigital-my-cloud-pr4100 (same device)

My Cloud OS 5 · Westerndigital

60%

v < 5.26.202

Affected range stops below 5.26.202, so it looks safe — our inference, not a vendor statement

My Cloud · Westerndigitaldevice

80%

All versions

My Cloud DL2100 · Westerndigitaldevice

80%

All versions

My Cloud DL4100 · Westerndigitaldevice

80%