CVE-2019-18931

Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer EIP control via crafted GET/POST parameters...

Western Digital SSD Dashboard and SanDisk SSD Dashboard Trust Management Issue Vulnerability

Western Digital SSD Dashboard and SanDisk SSD Dashboard are both products of Western Digital, Inc. Western Digital SSD Dashboard is a dashboard software for managing and monitoring SSD Solid State Drive devices. SanDisk SSD Dashboard is a dashboard software for managing and monitoring SanDisk SSD...

Western Digital SSD Dashboard and SanDisk SSD Dashboard Input Validation Error Vulnerability

Western Digital SSD Dashboard and SanDisk SSD Dashboard are both products of Western Digital, Inc. Western Digital SSD Dashboard is a dashboard software for managing and monitoring SSD Solid State Drive devices. SanDisk SSD Dashboard is a dashboard software for managing and monitoring SanDisk SSD...

CVE-2019-13467

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute...

CVE-2019-13467

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute...

Design/Logic Flaw

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute...

CVE-2019-13467

CVE-2019-13467 affects Western Digital SSD Dashboard and SanDisk SSD Dashboard prior to 2.5.1.0. The issue enables potential man-in-the-middle attacks when the dashboard web service resources are downloaded, allowing an attacker to substitute downloaded resources with arbitrary files. The connect...

CVE-2019-13467

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute...

CVE-2019-13466

Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available...

CVE-2019-13466

Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available...

Hardcoded credentials

Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available...

CVE-2019-13466

Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available...

CVE-2019-13466

Concretely affected: Western Digital SSD Dashboard and SanDisk SSD Dashboard prior to version 2.5.1.0. Vulnerability: Incorrect access control where the generate reports archive is protected with a hard-coded password. Root cause: insufficient access restrictions for archive generation. Impact: p...

Western Digital My Book World II NAS 1.02.12 Hardcoded Credential Vulnerability

Western Digital My Book World II NAS versions 1.02.12 and below have a hard-coded ssh credential that allows for remote command execution. Exploit Title: Western Digital My Book World II NAS = 1.02.12 - Broken Authentication to RCE Google Dork: intitle:"My Book World Edition - MyBookWorld" Exploi...

Western Digital My Book World II NAS 1.02.12 - Authentication Bypass / Command Execution

Exploit Title: Western Digital My Book World II NAS = 1.02.12 - Broken Authentication to RCE Google Dork: intitle:"My Book World Edition - MyBookWorld" Date: 19th Sep, 2019 Exploit Author: Noman Riffat, National Security Services Group NSSG Vendor Homepage: https://wd.com/ Software Link:...

Western Digital My Book World II NAS 1.02.12 Hardcoded Credential

Exploit Title: Western Digital My Book World II NAS = 1.02.12 - Broken Authentication to RCE Google Dork: intitle:"My Book World Edition - MyBookWorld" Date: 19th Sep, 2019 Exploit Author: Noman Riffat, National Security Services Group NSSG Vendor Homepage: https://wd.com/ Software Link:...

Western Digital My Book World II NAS 1.02.12 - Authentication Bypass Command Execution

Western Digital My Book World II NAS 1.02.12 - Authentication Bypass Command Execution Exploit Title: Western Digital My Book World II NAS = 1.02.12 - Broken Authentication to RCE Google Dork: intitle:"My Book World Edition - MyBookWorld" Date: 19th Sep, 2019 Exploit Author: Noman Riffat, Nationa...

CVE-2019-16399

Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/systemadvanced.php?lang=en and login with the default root password welc0me...

CVE-2019-16399

Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/systemadvanced.php?lang=en and login with the default root password welc0me...

CVE-2019-16399

The CVE affects Western Digital WD My Book World through II devices (firmware 1.02.12 and earlier). The vulnerability stems from Broken Authentication via a hardcoded SSH credential path, enabling an attacker to access the /admin/ directory without credentials and login with the default root pass...