CVE-2023-22816
Limited Post-Authentication Remote Command Injection in My Cloud Products
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: before 5.26.300.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Limited Post-Authentication Remote Command Injection in My Cloud Products
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: before 5.26.300.
- Record
CVE-2023-22816- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2023-26928
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: before 5.26.300.
- Record
EUVD-2023-26928- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5fx6-86fq-8xxf
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My...
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: before 5.26.300.
- Record
GHSA-5fx6-86fq-8xxf- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
NVD
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: before 5.26.300.
- Record
CVE-2023-22816- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78, CWE-77
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-22816 is a medium vulnerability (CVSS 6.0) in Western Digital My Cloud Os 5, published June 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. No source names a fixed version.