How severe is CVE-2022-23000?

CVE-2022-23000 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.

Is CVE-2022-23000 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-23000?

CVE-2022-23000 primarily affects Westerndigital My Cloud Pr2100 Firmware. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-23000?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-23000 published?

CVE-2022-23000 was published on 2022-07-25 and last updated on 2026-06-17.

CVE-2022-23000

CVE-2022-23000 is a high-severity vulnerability in Westerndigital My Cloud Pr2100 Firmware with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-757.

Key facts

Severity: High (CVSS 3.x base score 7.3)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-757
Affected product: Westerndigital My Cloud Pr2100 Firmware
Published: 2022-07-25
Last modified: 2026-06-17

Description

The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation, deprecated or insecure protocols are permitted. As a result, a local user with no privileges can exploit this vulnerability and jeopardize the integrity, confidentiality and authenticity of information transmitted. The scope of impact cannot extend to other components and no user input is required to exploit this vulnerability.

Frequently asked questions

What is CVE-2022-23000?: The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation, deprecated or insecure protocols are permitted. As a result, a local user with no privileges can exploit this vulnerability and jeopardize the integrity, confidentiality and authenticity of information transmitted. The scope of impact cannot extend to other components and no user input is required to exploit this vulnerability.
How severe is CVE-2022-23000?: CVE-2022-23000 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.
Is CVE-2022-23000 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-23000?: CVE-2022-23000 primarily affects Westerndigital My Cloud Pr2100 Firmware. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-23000?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2022-23000 published?: CVE-2022-23000 was published on 2022-07-25 and last updated on 2026-06-17.

References

https://www.westerndigital.com/support/product-security/wdc-22011-my-cloud-firmware-version-5-23-114

Affected products (9)

cpe:2.3:o:westerndigital:my_cloud_pr2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_pr4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_ex4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_ex2_ultra_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_mirror_g2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_dl2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_dl4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_ex2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Westerndigital My Cloud Pr2100 Firmware

CVE-2022-36331 — Critical (CVSS 10.0): Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation…
CVE-2022-22995 — Critical (CVSS 10.0): The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of…
CVE-2019-9950 — Critical (CVSS 9.8): Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100,…
CVE-2019-9949 — High (CVSS 8.8): Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before…
CVE-2022-22999 — High (CVSS 8.2): Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user…
CVE-2022-29844 — Medium (CVSS 6.7): A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119…

All CVEs affecting Westerndigital My Cloud Pr2100 Firmware →

Other CWE-757 vulnerabilities

CVE-2024-4995 — Critical (CVSS 9.8): Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an…
CVE-2024-38883 — Critical (CVSS 9.1): An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions,…
CVE-2019-14887 — Critical (CVSS 9.1): A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly…
CVE-2024-8773 — High (CVSS 8.3): SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an…
CVE-2018-25029 — High (CVSS 8.1): The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an…
CVE-2025-10693 — High (CVSS 7.6): When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a…

Browse all CWE-757 vulnerabilities →