CVE-2018-17153

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...

CVE-2018-17153

CVE-2018-17153 affects Western Digital My Cloud devices older than 2.30.196. An unauthenticated attacker can bypass authentication and become admin by abusing the network_mgr.cgi flow; after session creation, commands normally requiring admin privileges succeed if the cookie username=admin is set...

CVE-2018-17153

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...

PT-2018-13926 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud versions prior to 2.30.196 Description: The issue allows an unauthenticated attacker to bypass authentication and gain full control of the device by exploiting a vulnerability in the authentication mechanism...

Authentication bypass vulnerability in Western Digital My Cloud

Abstract It was discovered that Western Digital My Cloud is affected by an authentication bypass vulnerability. By exploiting this vulnerability, an unauthenticated attacker can bypass the login functionality and gain full control of the device. Tested versions This vulnerability was successfully...

Western Digital My Cloud vulnerable to multiple command injection vulnerabilities

Abstract It was discovered that the Western Digital My Cloud is affected by multiple command injection vulnerabilities. Some of these issues don’t require authentication and allow an attacker to gain complete control root access of the affected device. Some do require authentication, in this case...

Western Digital My Cloud EX2 NAS Device Leaks Files

UPDATE Western Digital’s My Cloud EX2 storage devices leak files to anyone on a local network by default, no matter the permissions set by users. If configured for remote access via the public internet, the My Cloud EX2 also leaks files via an HTTP request on port 9000, according to researchers a...

CVE-2018-9148

Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...

Authentication flaw

Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...

CVE-2018-9148

Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...

CVE-2018-9148

Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...

CVE-2018-9148

Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...

Western Digital My Cloud Pro Series PR2100 Authenticated RCE

Vulnerability Summary A vulnerability in the Western Digital My Cloud Pro Series PR2100 allows authenticated users to execute commands arbitrary commands. Credit An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program. Vendor...

New Western Digital My Cloud Bugs Give Local Attackers Root on NAS Devices

Researchers disclosed two new vulnerabilities in Western Digital My Cloud network storage devices on Thursday that could allow a local attacker to delete files stored on devices or allow them to execute shell commands as root. Researchers at Trustwave disclosed the vulnerabilities, which come on...

Western Digital My Cloud NAS Device Information Disclosure Vulnerability

The Western Digital MyCloud NAS is a network attached storage device. An information disclosure vulnerability exists in the Western Digital My Cloud NAS device, which allows an attacker to dump a list of all users, including detailed user information, without any authentication by sending a simpl...

Western Digital My Cloud NAS Appliance Denial of Service Vulnerability

The Western Digital MyCloud NAS is a network attached storage device. A denial of service vulnerability exists in the Western Digital My Cloud NAS device, which can be exploited by an attacker to conduct denial of service attacks because any unauthenticated user can set global language preference...

Unlimited File Upload Vulnerability in Western Digital My Cloud NAS Devices

The Western Digital MyCloud NAS is a network attached storage device. An unrestricted file upload vulnerability exists in the Western Digital My Cloud NAS device that could allow a remote attacker to upload an arbitrary file to a server running on a vulnerable Internet-connected storage device...

Western Digital My Cloud NAS Device Command Injection Vulnerability

The Western Digital MyCloud NAS is a network attached storage device. A command injection vulnerability exists in the Western Digital My Cloud NAS device, which can be exploited by an attacker to gain full control root access of an affected device...

Western Digital My Cloud NAS Device Cross-Site Request Forgery Vulnerability

The Western Digital MyCloud NAS is a network attached storage device. A cross-site request forgery vulnerability exists in the Western Digital My Cloud NAS device due to the lack of XSRF protection in the WD My Cloud web interface, which allows an attacker to connect a victim's web browser to the...

Western Digital My Cloud NAS Device Hardcoded Backdoor Vulnerability

The Western Digital MyCloud NAS is a network attached storage device. A hard-coded backdoor vulnerability exists in the Western Digital My Cloud NAS device, where an administrator username and password cannot be changed because they are hard-coded into a binary file, allowing an arbitrary user to...