PatchTheCVECVE-2022-29841: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that
CVE-2022-29841 is a high-severity flaw (CVSS 8.0) affecting my cloud os. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location and created a system command without sanitizing the read data. This command could be triggered by an attacker remotely to cause code execution and gain a reverse shell in Western Digital My Cloud OS 5 devices.This issue affects My Cloud OS 5: before 5.26.119.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.0 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 1.4% (top 27%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2023-05-10 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-29841?
my cloud os: upgrade to 5.26.119. Exact commands for each OS are on this page.
Is CVE-2022-29841 being exploited?
CVE-2022-29841 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-29841 affect?
CVE-2022-29841 affects my cloud os. Severity is high (CVSS 8.0). Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location and created a system command without sanitizing the read data.
How urgent is CVE-2022-29841?
Priority 46/100. High severity
Software pages
Western Digital vulnerabilities
Related CVEs
- CVE-2023-22814 CRITICAL 10.0 UPGRADE An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that co
- CVE-2022-29842 CRITICAL 9.8 UPGRADE Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could a
- CVE-2022-29840 MEDIUM 5.1 UPGRADE Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modif
- CVE-2022-29839 MEDIUM 4.1 UPGRADE Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Clo
- CVE-2022-29838 MEDIUM 4.3 UPGRADE Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My C