Is CVE-2022-29838 actively exploited?

No active exploitation of CVE-2022-29838 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-29838 be exploited remotely?

No. CVE-2022-29838 requires physical access to exploit.

What is the CVSS score of CVE-2022-29838?

CVE-2022-29838 has a CVSS score of 4.6 (MEDIUM).

HOME VULNERABILITIESCVE-2022-29838

MEDIUM

CVE-2022-29838

CWE-287Published: December 9, 2022· Updated: Jun 17, 2026

4.6

CVSS v3.1

Official Description

Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.

NVD Source

Technical Analysis

CVE-2022-29838 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 4.6.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorPhysical

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Vendors & Products

westerndigital11 product(s)

my cloud osmy cloudmy cloud dl2100my cloud dl4100my cloud ex2 ultramy cloud ex2100my cloud ex4100my cloud mirror g2my cloud pr2100my cloud pr4100wd cloud

Source: NVD CPE · 11 total CPE entries