Is CVE-2023-22817 actively exploited?

No active exploitation of CVE-2023-22817 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-22817 be exploited remotely?

No. CVE-2023-22817 requires local access to exploit.

What is the CVSS score of CVE-2023-22817?

CVE-2023-22817 has a CVSS score of 5.5 (MEDIUM).

HOME VULNERABILITIESCVE-2023-22817

MEDIUM

CVE-2023-22817

CWE-918Published: February 5, 2024· Updated: Jun 17, 2026

5.5

CVSS v3.1

Official Description

Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed by fixing DNS addresses that refer to loopback. This issue affects My Cloud OS 5 devices before 5.27.161, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices before 9.5.1-104.

NVD Source

Technical Analysis

CVE-2023-22817 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 5.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected Vendors & Products

westerndigital26 product(s)

my cloud pr2100 firmwaremy cloud pr2100my cloud pr4100 firmwaremy cloud pr4100my cloud ex4100 firmwaremy cloud ex4100my cloud ex2 ultra firmwaremy cloud ex2 ultramy cloud mirror g2 firmwaremy cloud mirror g2my cloud dl2100 firmwaremy cloud dl2100+14

Source: NVD CPE · 26 total CPE entries