Multiple vulnerabilities in Western Digital My Cloud OS 5
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 18 |
| CVE-ID | CVE-2022-27776 CVE-2022-29839 CVE-2021-0561 CVE-2022-32208 CVE-2022-32207 CVE-2022-32206 CVE-2022-32205 CVE-2022-27782 CVE-2022-27781 CVE-2022-27775 CVE-2022-22576 CVE-2021-22947 CVE-2021-22946 CVE-2021-22945 CVE-2021-22924 CVE-2021-22898 CVE-2021-33655 CVE-2022-29838 |
| CWE-ID | CWE-200 CWE-522 CWE-125 CWE-347 CWE-276 CWE-400 CWE-303 CWE-835 CWE-399 CWE-287 CWE-345 CWE-319 CWE-415 CWE-295 CWE-457 CWE-787 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
My Cloud Mirror G2 Hardware solutions / Other hardware appliances WD Cloud Hardware solutions / Other hardware appliances My Cloud EX2100 Hardware solutions / Other hardware appliances My Cloud DL4100 Hardware solutions / Other hardware appliances My Cloud DL2100 Hardware solutions / Other hardware appliances My Cloud EX4100 Hardware solutions / Other hardware appliances My Cloud EX2 Ultra Hardware solutions / Other hardware appliances My Cloud PR4100 Hardware solutions / Other hardware appliances My Cloud PR2100 Hardware solutions / Other hardware appliances My Cloud Hardware solutions / Office equipment, IP-phones, print servers My Cloud OS 5 Operating systems & Components / Operating system |
| Vendor | Western Digital |
Security Bulletin
This security bulletin contains information about 18 vulnerabilities.
1) Information disclosure
EUVDB-ID: #VU62644
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-27776
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to curl can leak authentication or cookie header data during HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hosts will make curl send the data to those. However, due to a flawed check, curl wrongly also sends that same set of headers to the hosts that are identical to the first one but use a different port number or URL scheme.
The vulnerability exists due to an incomplete fix for #VU10224 (CVE-2018-1000007).
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Insufficiently protected credentials
EUVDB-ID: #VU69921
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-29839
CWE-ID:
CWE-522 - Insufficiently Protected Credentials
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficiently protected credentials. A remote attacker can gain access protected data.
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Out-of-bounds read
EUVDB-ID: #VU69342
Risk: Low
CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-0561
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the append_to_verify_fifo_interleaved_ in stream_encoder.c in Media Framework. A local application can trigger an out-of-bounds read error and read contents of memory on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper Verification of Cryptographic Signature
EUVDB-ID: #VU64685
Risk: Medium
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-32208
CWE-ID:
CWE-347 - Improper Verification of Cryptographic Signature
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to improper handling of message verification failures when performing FTP transfers secured by krb5. A remote attacker can perform MitM attack and manipulate data.
Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Incorrect default permissions
EUVDB-ID: #VU64684
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-32207
CWE-ID:
CWE-276 - Incorrect Default Permissions
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to incorrect default permissions set to cookies, alt-svc and hsts data stored in local files. A local user with ability to read such files can gain access to potentially sensitive information.
Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Resource exhaustion
EUVDB-ID: #VU64682
Risk: Medium
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-32206
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insecure processing of compressed HTTP responses. A malicious server can send a specially crafted HTTP response to curl and perform a denial of service attack by forcing curl to spend enormous amounts of allocated heap memory, or trying to and returning out of memory errors.
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Resource exhaustion
EUVDB-ID: #VU64681
Risk: Medium
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-32205
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to curl does not impose limits to the size of cookies stored in the system. A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and consume all available disk space.
Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Incorrect Implementation of Authentication Algorithm
EUVDB-ID: #VU63009
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-27782
CWE-ID:
CWE-303 - Incorrect Implementation of Authentication Algorithm
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the way libcurl handles previously used connections in a connection pool for subsequent transfers. Several TLS and SSH settings were left out from the configuration match checks, resulting in erroneous matches for different resources. As a result, libcurl can send authentication string from one resource to another, exposing credentials to a third-party.
Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Infinite loop
EUVDB-ID: #VU63008
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-27781
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when handling requests with the CURLOPT_CERTINFO option. A remote attacker can consume all available system resources and cause denial of service conditions.
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Resource management error
EUVDB-ID: #VU62643
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-27775
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper management of internal resources when handling IPv6 protocol. Due to errors in the logic, the config matching function did not take the IPv6 address zone id into account which could lead to libcurl reusing the wrong connection when one transfer uses a zone id and a subsequent transfer uses another (or no) zone id.
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Improper Authentication
EUVDB-ID: #VU62640
Risk: Medium
CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-22576
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when re-using OAUTH2 connections for SASL-enabled protocols, such as SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). libcurl may reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. As a result, a connection that is successfully created and authenticated with a user name + OAUTH2 bearer can subsequently be erroneously reused even for user + [other OAUTH2 bearer], even though that might not even be a valid bearer.
A remote attacker can exploit this vulnerability against applications intended for use in multi-user environments to bypass authentication and gain unauthorized access to victim's accounts.
Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Insufficient verification of data authenticity
EUVDB-ID: #VU56615
Risk: Medium
CVSSv4.0: 4.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-22947
CWE-ID:
CWE-345 - Insufficient Verification of Data Authenticity
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists in the way libcurl handles the STARTTLS negotiation process. When curl connects to an IMAP, POP3, SMTP or FTP server to exchange data securely using STARTTLS to upgrade the connection to TLS level, the server can still respond and send back multiple responses before the TLS upgrade. Such multiple "pipelined" responses are cached by curl. curl would then upgrade to TLS but not flush the in-queue of cached responses and instead use and trust the responses it got before the TLS handshake as if they were authenticated.
Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
Over POP3 and IMAP an attacker can inject fake response data.
Mitigation
Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Cleartext transmission of sensitive information
EUVDB-ID: #VU56613
Risk: Medium
CVSSv4.0: 4.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-22946
CWE-ID:
CWE-319 - Cleartext Transmission of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error, related to incorrect enforcement of the --ssl-reqd option on the command line or CURLOPT_USE_SSL setting set to CURLUSESSL_CONTROL or CURLUSESSL_ALL with libcurl. A remote attacker with control over the IMAP, POP3 or FTP server can send a specially crafted but perfectly legitimate response to the libcurl client and force it silently to continue its operations without TLS encryption and transmit data in clear text over the network.
Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Double Free
EUVDB-ID: #VU56610
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-22945
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when sending data to an MQTT server. A remote attacker with ability to control libcurl input can trigger a double free error and perform a denial of service (DoS) attack.
Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
15) Improper Certificate Validation
EUVDB-ID: #VU55146
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-22924
CWE-ID:
CWE-295 - Improper Certificate Validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to errors in the logic when the config matching function does not take "issuer cert" into account and it compares the involved paths case insensitively. A remote attacker can gain access to sensitive information on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
16) Use of uninitialized variable
EUVDB-ID: #VU53587
Risk: Medium
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-22898
CWE-ID:
CWE-457 - Use of Uninitialized Variable
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to usage of uninitialized variable in code, responsible for processing TELNET requests when parsing NEW_ENV variables. A remote attacker can force the affected application to connect to a telnet server under attackers control and read up to 1800 bytes from the uninitialized memory on the libcurl client system.
Proof of concept:
curl telnet://example.com -tNEW_ENV=a,bbbbbb (256 'b's)Install update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
17) Out-of-bounds write
EUVDB-ID: #VU65833
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-33655
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
Description The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in FBIOPUT_VSCREENINFO IOCTL. A local user can trigger an out-of-bounds write error and execute arbitrary code with elevated privileges.
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
18) Improper Authentication
EUVDB-ID: #VU69918
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-29838
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper authentication within the encrypted volumes and auto mount feature. A remote attacker can gain a direct access to the drive information in the case of a device reset.
MitigationInstall update from vendor's website.
Vulnerable software versionsMy Cloud Mirror G2: All versions
WD Cloud: All versions
My Cloud: All versions
My Cloud EX2100: All versions
My Cloud DL4100: All versions
My Cloud DL2100: All versions
My Cloud EX4100: All versions
My Cloud EX2 Ultra: All versions
My Cloud PR4100: All versions
My Cloud PR2100: All versions
My Cloud OS 5: before 5.25.124
CPE2.3- cpe:2.3:h:western_digital:my_cloud_mirror_g2:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:wd_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_ex2_ultra:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*
- cpe:2.3:h:western_digital:my_cloud_pr2100:*:*:*:*:*:*:*:*
- cpe:2.3:o:western_digital:my_cloud_os_5:*:*:*:*:*:*:*:*
https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
