Critical Unpatched Flaws Disclosed In Western Digital 'My Cloud' Storage Devices

Security researchers have discovered several severe vulnerabilities and a secret hard-coded backdoor in Western Digital's My Cloud NAS devices that could allow remote attackers to gain unrestricted root access to the device. Western Digital's My Cloud WDMyCloud is one of the most popular...

WDMyCloud 2.30.165 CSRF / File Upload / Code Execution / Backdoor / DoS

Released Date: 2018-01-04 Last Modified: 2017-06-11 Company Info: Western Digital Version Info: Vulnerable MyCloud = 2.30.165 MyCloudMirror = 2.30.165 My Cloud Gen 2 My Cloud PR2100 My Cloud PR4100 My Cloud EX2 Ultra My Cloud EX2 My Cloud EX4 My Cloud EX2100 My Cloud EX4100 My Cloud DL2100 My Clo...

Western Digital My Cloud File Upload Vulnerability

Western Digital My Cloud is prone to a file upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/o:wdc";...

Western Digital My Cloud Products Authentication Bypass and Remote Command Injection Vulnerability

Western Digital My Cloud Products are prone to an authentication bypass and multiple remote command injection vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Western Digital My Cloud Products Dropbox App RCE Vulnerability

The Dropbox App of Western Digital My Cloud products is prone to an unauthenticated remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Western Digital My Cloud Authentication Vulnerability

Western Digital MyCloud is a personal cloud storage device. An authentication vulnerability exists in Western Digital MyCloud. An unauthenticated attacker could be allowed to exploit this vulnerability to bypass administrator authentication and gain control of device privileges...

Western Digital My Cloud 2.21.126 Authentication Bypass

------------------------------------------------------------------------ Authentication bypass vulnerability in Western Digital My Cloud allows escalation to admin privileges ------------------------------------------------------------------------ Remco Vermeulen, April 2017...

Western Digital My Cloud Cross Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications ------------------------------------------------------------------------ Western Digital My Cloud vulnerable to Cross-Site Request Forgery vulnerability ------------------------------------------------------------------------ Remco...

Western Digital My Cloud Command Injection / File Upload Vulnerabilities

Exploit for hardware platform in category web applications title: Unauthenticated OS command injection & arbitrary file upload product: Western Digital My Cloud vulnerable version: at least: 2.21.126 My Cloud, 2.11.157My Cloud EX2, 2.21.126 My Cloud EX2 Ultra, 2.11.157 My Cloud EX4, 2.21.126 My...

Western Digital My Cloud Buffer Overflow Vulnerability

Exploit for hardware platform in category web applications ------------------------------------------------------------------------ Stack-based buffer overflow in Western Digital My Cloud allows for remote code execution ------------------------------------------------------------------------ Rem...

Western Digital My Cloud Command Injection Vulnerability

Exploit for hardware platform in category web applications ------------------------------------------------------------------------ Western Digital My Cloud vulnerable to multiple command injection vulnerabilities ------------------------------------------------------------------------ Remco...

Unpatched Western Digital Bugs Leave NAS Boxes Open to Attack

Western Digital Corporation network-attached storage owners were warned of critical flaws in the company’s My Cloud line of hardware that exposed data stored on the devices to attack. The flaws impact a dozen Western Digital drives that could allow remote adversaries to bypass logins, insert...

Western Digital My Cloud Buffer Overflow

------------------------------------------------------------------------ Stack-based buffer overflow in Western Digital My Cloud allows for remote code execution ------------------------------------------------------------------------ Remco Vermeulen, January 2017...

Western Digital My Cloud 2.21.119 Authentication Bypass

------------------------------------------------------------------------ Authentication bypass vulnerability in Western Digital My Cloud ------------------------------------------------------------------------ Remco Vermeulen, Januari 2017...

Multiple Vulnerabilities in WD My Cloud Mirror

My Cloud Mirror is the My Cloud personal cloud storage device from Western Digital. Authentication bypass and remote code execution vulnerabilities exist in WD My Cloud Mirror, which can be exploited by an attacker to bypass restrictions, perform unauthorized operations or execute arbitrary code...

WD My Cloud Mirror 2.11.153 Remote Command Execution / Authentication Bypass

Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: local 1. Description Itas possible to execute arbitra...

WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/...

WD My Cloud Mirror 2.11.153 - Authentication Bypass / Remote Code Execution

Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass Date: 24.01.2017 Software Link: https://www.wdc.com Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: local 1. Description It’s possible to execute arbitra...

Western Digital My Cloud / WD Cloud Products Detection (HTTP)

HTTP based detection of Western Digital My Cloud products Called SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Western Digital My Cloud Command Injection

Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link: http://download.wdc.com/nas/sq-040104-422-20150423.deb.zip Exploit Author: James Sibley absane ; twitter =...