CVE-2016-10108: Improper Neutralization of Special Elements used in a Command

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

CVE-2016-10107: Improper Neutralization of Special Elements used in a Command

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header...

PT-2016-3231 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital MyCloud NAS version 2.11.142 Description: The issue is related to unauthenticated remote command injection as root in the Western Digital MyCloud NAS. This occurs via a modified arg parameter in the POST data to the "/web/goog...

PT-2016-3232

Name of the Vulnerable Software and Affected Versions Western Digital MyCloud NAS version 2.11.142 Description The issue concerns an unauthenticated remote command injection that can be executed as root. This occurs due to a vulnerability in the index.php page of the Western Digital MyCloud NAS,...

Western Digital MyCloud unauthenticated command injection

This module exploits authentication bypass CVE-2018-17153 and command injection CVE-2016-10108 vulnerabilities in Western Digital MyCloud before 2.30.196 in order to achieve unauthenticated remote code execution as the root user. The module first performs a check to see if the target is WD MyClou...