# cve.now: Western Digital

The newest entries naming Western Digital as an affected vendor (up to 200), of 45 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-30248](https://cve.now/CVE-2025-30248.md): DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary (CVSS 8.9)
- [CVE-2025-30247](https://cve.now/CVE-2025-30247.md): An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remot (CVSS 9.3)
- [CVE-2025-57699](https://cve.now/CVE-2025-57699.md): Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. (CVSS 6.7)
- [CVE-2024-22170](https://cve.now/CVE-2024-22170.md): Unchecked buffer in Dynamic DNS client (CVSS 9.2)
- [CVE-2024-22169](https://cve.now/CVE-2024-22169.md): Misconfiguration in node.js causing a code execution in WD Discovery (CVSS 7.1)
- [CVE-2024-22168](https://cve.now/CVE-2024-22168.md): Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps (CVSS 5.9)
- [CVE-2023-22819](https://cve.now/CVE-2023-22819.md): Uncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products (CVSS 4.9)
- [CVE-2023-22817](https://cve.now/CVE-2023-22817.md): Server-side Request Forgery vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products (CVSS 5.5)
- [CVE-2023-22814](https://cve.now/CVE-2023-22814.md): Authentication Bypass issue in My Cloud OS 5 devices (CVSS 10.0)
- [CVE-2023-22815](https://cve.now/CVE-2023-22815.md): Post-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devices (CVSS 6.2)
- [CVE-2023-22816](https://cve.now/CVE-2023-22816.md): Limited Post-Authentication Remote Command Injection in My Cloud Products (CVSS 6.0)
- [CVE-2022-36331](https://cve.now/CVE-2022-36331.md): Impersonation attack causing an Authentication Bypass on Western Digital devices (CVSS 10.0)
- [CVE-2022-36328](https://cve.now/CVE-2022-36328.md): Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devices (CVSS 5.8)
- [CVE-2022-36327](https://cve.now/CVE-2022-36327.md): Path traversal vulnerability leading to an arbitrary file write in Western Digital devices (CVSS 5.8)
- [CVE-2022-36326](https://cve.now/CVE-2022-36326.md): Resource Exhaustion Vulnerability in Western Digital devices (CVSS 4.4)
- [CVE-2022-29840](https://cve.now/CVE-2022-29840.md): Server Side Request Forgery Vulnerability in Western Digital My Cloud Devices (CVSS 5.1)
- [CVE-2022-29841](https://cve.now/CVE-2022-29841.md): OS Command Injection vulnerability in Western Digital My Cloud devices (CVSS 8.0)
- [CVE-2022-29842](https://cve.now/CVE-2022-29842.md): Command Injection Vulnerability in Western Digital My Cloud devices (CVSS 9.8)
- [CVE-2022-36329](https://cve.now/CVE-2022-36329.md): Denial of Service over OTA mechanism in Western Digital My Cloud Home and ibi devices (CVSS 4.4)
- [CVE-2022-36330](https://cve.now/CVE-2022-36330.md): Buffer Overflow Vulnerability in Western Digital My Cloud Home and ibi devices (CVSS 1.9)
- [CVE-2023-22813](https://cve.now/CVE-2023-22813.md): Device API endpoint missing access controls on Western Digital Mobile and Web Apps (CVSS 3.3)
- [CVE-2022-29844](https://cve.now/CVE-2022-29844.md): Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp (CVSS 6.7)
- [CVE-2022-29843](https://cve.now/CVE-2022-29843.md): Western Digital My Cloud OS 5 devices Command Injection Vulnerability (CVSS 6.2)
- [CVE-2022-29839](https://cve.now/CVE-2022-29839.md): Remote Backups Application Discloses Stored Credentials (CVSS 4.1)
- [CVE-2022-29838](https://cve.now/CVE-2022-29838.md): Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices (CVSS 4.3)
- [CVE-2022-29837](https://cve.now/CVE-2022-29837.md): Path traversal Vulnerability in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi Devices (CVSS 4.7)
- [CVE-2022-29836](https://cve.now/CVE-2022-29836.md): Post-Auth Path Traversal Vulnerability Allows to Custom Package Installation via HTTP API (CVSS 1.9)
- [CVE-2022-23006](https://cve.now/CVE-2022-23006.md): Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi (CVSS 1.8)
- [CVE-2022-29835](https://cve.now/CVE-2022-29835.md): WD Discovery's Use of Weak Hashing Algorithm for Code Signing (CVSS 5.3)
- [CVE-2022-23004](https://cve.now/CVE-2022-23004.md): Algorithm incorrectly returning error and Invalid unreduced value written to output buffer (CVSS 5.3)
- [CVE-2022-23003](https://cve.now/CVE-2022-23003.md): Shared secret or Point multiplication of NIST P-256 points with X coordinate of zero (CVSS 5.3)
- [CVE-2022-23002](https://cve.now/CVE-2022-23002.md): Point Compression/Decompression of NIST P-256 points with X coordinate of zero (CVSS 5.3)
- [CVE-2022-23001](https://cve.now/CVE-2022-23001.md): Sweet-B Library: Point compress/decompress using the wrong bit for sign (CVSS 5.3)
- [CVE-2022-22999](https://cve.now/CVE-2022-22999.md): Cross-site Scripting Vulnerability in USB Backups App (CVSS 8.2)
- [CVE-2022-23000](https://cve.now/CVE-2022-23000.md): Weak Default SSL use in Port Forwarding Service (CVSS 7.3)
- [CVE-2022-22997](https://cve.now/CVE-2022-22997.md): Command Injection Vulnerability on My Cloud Home (CVSS 6.8)
- [CVE-2022-22998](https://cve.now/CVE-2022-22998.md): Protecting AWS credentials stored in plaintext on My Cloud Home (CVSS 8.0)
- [CVE-2022-22995](https://cve.now/CVE-2022-22995.md): Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk (CVSS 10.0)
- [CVE-2022-22994](https://cve.now/CVE-2022-22994.md): Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices. (CVSS 8.8)
- [CVE-2022-22993](https://cve.now/CVE-2022-22993.md): Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices. (CVSS 7.8)
- [CVE-2022-22988](https://cve.now/CVE-2022-22988.md): Insecure file and directory permissions on EdgeRover (CVSS 7.7)
- [CVE-2022-22990](https://cve.now/CVE-2022-22990.md): Limited authentication bypass vulnerability on Western Digital My Cloud devices (CVSS 7.8)
- [CVE-2022-22991](https://cve.now/CVE-2022-22991.md): Command injection through unsecured HTTP calls on Western Digital My Cloud devices (CVSS 7.8)
- [CVE-2022-22989](https://cve.now/CVE-2022-22989.md): Pre-authenticated stack overflow vulnerability on FTP Service (CVSS 9.8)
- [CVE-2018-1151](https://cve.now/CVE-2018-1151.md): The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrar (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/western-digital
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.