Western Digital vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-30248 DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement oHigh 8.9 · Jan 26, 2026
• CVE-2025-30247 An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execuCritical 9.3 · Sep 29, 2025
• CVE-2025-57699 Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path.High 8.4 · Aug 22, 2025
• CVE-2024-22170 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.ThCritical 9.2 · Sep 27, 2024
• CVE-2024-22169 WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONHigh 7.1 · Aug 2, 2024
• CVE-2023-22814 An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonatioCritical 10 · Jun 30, 2023
• CVE-2022-36331 Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticatCritical 10 · Jun 12, 2023
• CVE-2022-29841 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a priHigh 8 · May 10, 2023
• CVE-2022-29842 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context ofCritical 9.8 · May 10, 2023
• CVE-2022-23000 The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules.High 7.3 · Jul 25, 2022
• CVE-2022-22999 Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to driveHigh 8.2 · Jul 25, 2022
• CVE-2022-22998 Implemented protections on AWS credentials that were not properly protected.High 8 · Jul 12, 2022
• CVE-2022-22995 The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files.Critical 10 · Mar 25, 2022
• CVE-2022-22994 A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unseHigh 8.8 · Jan 28, 2022
• CVE-2022-22993 A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the sHigh 7.8 · Jan 28, 2022
• CVE-2022-22991 A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP callHigh 7.8 · Jan 13, 2022
• CVE-2022-22990 A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My CloHigh 7.8 · Jan 13, 2022
• CVE-2022-22989 My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the Critical 9.8 · Jan 13, 2022
• CVE-2022-22988 File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources.High 7.7 · Jan 13, 2022
• CVE-2020-8990 Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.Critical 9.1 · Feb 20, 2020
• CVE-2019-18931 Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via crafted GET/POST parameters.High 8.8 · Nov 13, 2019
• CVE-2019-18930 Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest account) to remotely execute arbitrary code via a stack-based buffer overHigh 8.8 · Nov 13, 2019
• CVE-2019-18929 Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest accounts) to remotely execute arbitrary code via a download_mgr.cgi stackHigh 8.8 · Nov 13, 2019
• CVE-2019-9951 Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My CCritical 9.8 · Apr 24, 2019
• CVE-2018-17153 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability.Critical 9.8 · Sep 18, 2018