Western Digital WD Discovery vulnerabilities

3 vulnerabilities

Known vulnerabilities in Western Digital WD Discovery, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.9CVE-2025-30248western digitalwd discovery
EPSS score
0.61%
DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in the installer's search path.5.3CVE-2022-29835western digitalwd discovery+1
EPSS score
0.20%
WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows.7.1CVE-2024-22169western digitalwd discovery
EPSS score
0.26%
WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.