Western Digital vulnerabilities and fixes

CVEs that mention Western Digital, ranked by priority. 6 tracked.

Western Digital has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-01-26. Highest priority: CVE-2025-30247 (score 54/100).

• CVE-2025-30247 CRITICAL 9.3 An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108
• CVE-2024-22170 CRITICAL 9.2 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cl
• CVE-2025-30248 HIGH 8.9 DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local
• CVE-2025-7779 HIGH 8.8 Local privilege escalation due to insecure XPC service configuration
• CVE-2025-11178 HIGH 7.3 Local privilege escalation due to DLL hijacking vulnerability
• CVE-2025-57699 MEDIUM 6.7 Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an

FAQ

How do I fix Western Digital vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Western Digital being exploited right now?

None of the tracked Western Digital CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Western Digital CVE should I patch first?

CVE-2025-30247 currently ranks highest (54/100): An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108.

RSS feed for Western Digital · ← Back to latest CVEs