Western Digital MyCloud NAS - Authentication Bypass Detection

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...

EUVD-2016-1298

Malware in sbrugna...

VulnCheck KEV: CVE-2016-10108

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

Western Digital MyCloud NAS Buffer Overflow Privilege Escalation

The vulnerability of Western Digital MyCloud NAS’ network storage software relates to writing beyond the buffer limits of memory. Exploiting this vulnerability can allow a remote attacker to gain elevated privileges...

Western Digital MyCloud NAS cgi_api.php Code Execution

The vulnerability of the cgiapi.php component in the Western Digital MyCloud NAS network storage software is related to insecure privilege management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2020-4931

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud NAS versions prior to 5.04.114 Description: The issue is related to insecure privilege management in the AvailableApps.php component of Western Digital MyCloud NAS microprogram software. It allows a remote attacker to...

Western Digital MyCloud NAS Arbitrary Command Execution

The vulnerability of the “index.php” script in the microprogramming software of Western Digital MyCloud NAS is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially...

Western Digital MyCloud NAS Command Execution

The vulnerability of the “/web/googleanalytics.php” microprogramming software of Western Digital MyCloud NAS is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows a malicious actor to inject arbitrary commands using a specially...

Western Digital MyCloud NAS Remote Command Injection Vulnerability (CNVD-2017-00115)

Western Digital MyCloud NAS is a personal cloud storage device. Western Digital MyCloud NAS version 2.11.142 has a remote command injection vulnerability in index.php, which allows an attacker to execute arbitrary commands with root privileges via a cookie header...

CVE-2016-10108

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

CVE-2016-10107

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header...

Command injection

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

CVE-2016-10108

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

CVE-2016-10107

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header...

Command injection

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header...

CVE-2016-10108: Improper Neutralization of Special Elements used in a Command

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

CVE-2016-10108

CVE-2016-10108 : Western Digital MyCloud NAS (around version 2.11.142) is vulnerable to an unauthenticated remote command injection via the POST parameter arg in the /web/google_analytics.php endpoint, enabling potential root access. The CVSS metrics listed (3.0: 9.8, CRITICAL; 2.0: 10.0) reflect...

PT-2016-3232

Name of the Vulnerable Software and Affected Versions Western Digital MyCloud NAS version 2.11.142 Description The issue concerns an unauthenticated remote command injection that can be executed as root. This occurs due to a vulnerability in the index.php page of the Western Digital MyCloud NAS,...