PatchTheCVECVE-2022-22999: Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malic
CVE-2022-22999 is a high-severity flaw (CVSS 8.2) affecting my cloud pr2100 firmware, my cloud pr4100 firmware, my cloud ex4100 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser. As a result, it may be possible to gain control over the authenticated session, steal data, modify settings, or redirect the user to malicious websites. The scope of impact can extend to oth
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.2 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2022-07-25 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-22999?
my cloud pr2100 firmware: upgrade to 5.23.114; my cloud pr4100 firmware: upgrade to 5.23.114; my cloud ex4100 firmware: upgrade to 5.23.114. Exact commands for each OS are on this page.
Is CVE-2022-22999 being exploited?
CVE-2022-22999 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-22999 affect?
CVE-2022-22999 affects my cloud pr2100 firmware, my cloud pr4100 firmware, my cloud ex4100 firmware. Severity is high (CVSS 8.2). Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authentica
How urgent is CVE-2022-22999?
Priority 37/100. High severity
Software pages
Western Digital vulnerabilities
Related CVEs
- CVE-2022-36331 CRITICAL 10.0 UPGRADE UPGRADE Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impe
- CVE-2022-29844 MEDIUM 6.7 UPGRADE UPGRADE A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to
- CVE-2022-29843 MEDIUM 6.2 UPGRADE UPGRADE A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices r
- CVE-2022-23000 HIGH 7.3 UPGRADE UPGRADE The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to conf
- CVE-2022-22995 CRITICAL 10.0 UPGRADE UPGRADE The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writi