CVE-2022-29838 MEDIUM

CVE-2022-29838: Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices

Vendor Western Digital

Product My Cloud

Weakness CWE-287 · Improper authentication

Published December 9, 2022

Last update April 23, 2025

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Physical

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

Key dates

02Disclosure timeline

December 9, 2022 CVE published

April 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-29838 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2026-49443 authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API CVE-2026-34123 Whitelist Validation Bypass in TP-Link Tapo C520WS CVE-2026-55955 Apache Tomcat: EncryptInterceptor not protected against replay attacks CVE-2026-46705 russh server userauth state is not reset when authentication principal changes CVE-2026-10611 OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled