CVE-2022-29844: A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to
48
This week
MEDIUM 6.7UPGRADEUPGRADEUPGRADE
CVE-2022-29844 is a medium-severity flaw (CVSS 6.7) affecting my cloud pr2100 firmware, my cloud pr4100 firmware, my cloud ex4100 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
Published CVE record published
Updated Record last modified
westerndigital my cloud pr2100 firmware UPGRADE
Affected: < 5.26.119
Fixed in: 5.26.119
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
westerndigital my cloud pr4100 firmware UPGRADE
Affected: < 5.26.119
Fixed in: 5.26.119
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
westerndigital my cloud ex4100 firmware UPGRADE
Affected: < 5.26.119
Fixed in: 5.26.119
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
westerndigital my cloud ex2 ultra firmware UPGRADE
Affected: < 5.26.119
Fixed in: 5.26.119
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
westerndigital my cloud mirror g2 firmware UPGRADE
Affected: < 5.26.119
Fixed in: 5.26.119
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
westerndigital my cloud dl2100 firmware UPGRADE
Affected: < 5.26.119
Fixed in: 5.26.119
Safe to downgrade to: no unaffected older release
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-29844?
my cloud pr2100 firmware: upgrade to 5.26.119; my cloud pr4100 firmware: upgrade to 5.26.119; my cloud ex4100 firmware: upgrade to 5.26.119. Exact commands for each OS are on this page.
Is CVE-2022-29844 being exploited?
CVE-2022-29844 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-29844 affect?
CVE-2022-29844 affects my cloud pr2100 firmware, my cloud pr4100 firmware, my cloud ex4100 firmware. Severity is medium (CVSS 6.7). A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote exe
How urgent is CVE-2022-29844?
Priority 48/100. EPSS top 2%: very likely to be exploited
CVE-2022-36331CRITICAL 10.0UPGRADEUPGRADE Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impe
CVE-2022-29843MEDIUM 6.2UPGRADEUPGRADE A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices r
CVE-2022-23000HIGH 7.3UPGRADEUPGRADE The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to conf
CVE-2022-22999HIGH 8.2UPGRADEUPGRADE Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malic
PatchTheCVE