CVE-2023-22816

Limited Post-Authentication Remote Command Injection in My Cloud Products

HIGH

8.8

CVSS Score

Published: June 30, 2023 at 09:01 PM UTC

Updated: June 17, 2026 at 05:36 AM UTC

12 products affected across 1 vendorMy Cloud OSMy Cloud PR4100My Cloud EX4100

Using My Cloud OS 5 by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud OS 5 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.9%

SSVC

No known exploit

Description

A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: before 5.26.300.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud OS · Westerndigital

95%

v < 5.26.300

Affected range stops below 5.26.300, so it looks safe — our inference, not a vendor statement

westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device) · westerndigital-my-cloud-dl2100 (same device) · westerndigital-my-cloud-dl4100 (same device) · westerndigital-my-cloud-ex2-ultra (same device) · westerndigital-my-cloud-ex2100 (same device) · westerndigital-my-cloud-ex4100 (same device) · westerndigital-my-cloud-mirror-g2 (same device) · westerndigital-my-cloud-pr2100 (same device) · westerndigital-my-cloud-pr4100 (same device)

My Cloud OS 5 · Westerndigital

60%

v < 5.26.300

Affected range stops below 5.26.300, so it looks safe — our inference, not a vendor statement

My Cloud · Westerndigitaldevice

80%

All versions

My Cloud DL2100 · Westerndigitaldevice

80%

All versions

My Cloud DL4100 · Westerndigitaldevice

80%