CVE-2023-22814 | An authentication bypass issue via spoofing was discovered i… | CVSS 10.0 CRITICAL

Description

An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before 5.26.202.

Metadata

CVE ID: CVE-2023-22814
State: PUBLISHED
Assigner: WDC PSIRT
Reserved: 2023-01-06 20:23 UTC
Published: 2023-06-30 23:05 UTC
Last updated: 2024-11-26 16:09 UTC
Primary CWE: CWE-290
CWE-290 Authentication Bypass by Spoofing
Vendor / Product: Western Digital / My Cloud OS 5
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Western Digital	My Cloud OS 5	Linux	0 < 5.26.202

Weakness (CWE)

CWE	Source	Description
CWE-290	cna	CWE-290 Authentication Bypass by Spoofing

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

References (1)

https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202