Multiple vulnerabilities in Western Digital My Cloud OS 5

Published: 2025-03-06 | Updated: 2025-03-07

Risk	High
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2023-4911 CVE-2023-4154 CVE-2023-38545 CVE-2023-38546
CWE-ID	CWE-119 CWE-200 CWE-122 CWE-73
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Public exploit code for vulnerability #3 is available.
Vulnerable software	My Cloud (P/N: WDBCTLxxxxxx-10) Hardware solutions / Other hardware appliances My Cloud EX2100 Hardware solutions / Other hardware appliances My Cloud DL4100 Hardware solutions / Other hardware appliances My Cloud Mirror Gen 2 Hardware solutions / Other hardware appliances My Cloud EX4100 Hardware solutions / Other hardware appliances My Cloud EX2 Ultra Hardware solutions / Other hardware appliances My Cloud PR4100 Hardware solutions / Other hardware appliances My Cloud PR2100 Hardware solutions / Other hardware appliances My Cloud OS 5 Operating systems & Components / Operating system
Vendor	Western Digital

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU81437

Risk: Low

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2023-4911

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of GLIBC_TUNABLES environment variable. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud (P/N: WDBCTLxxxxxx-10): All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud Mirror Gen 2: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.30.103

CPE2.3

External links

https://www.westerndigital.com/support/product-security/wdc-25001-western-digital-my-cloud-os-5-firmware-5-30-103

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Information disclosure

EUVDB-ID: #VU81874

Risk: Medium

CVSSv4.0: 5.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-4154

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a design error in Samba's implementation of the DirSync control, which can allow replication of critical domain passwords and secrets by Active Directory accounts authorized to do some replication, but not to replicate sensitive attributes. A remote user can obtain sensitive information from the AD DC and compromise the Active Directory.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud (P/N: WDBCTLxxxxxx-10): All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud Mirror Gen 2: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.30.103

CPE2.3

External links

https://www.westerndigital.com/support/product-security/wdc-25001-western-digital-my-cloud-os-5-firmware-5-30-103

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer overflow

EUVDB-ID: #VU81865

Risk: High

CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2023-38545

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the SOCKS5 proxy handshake. A remote attacker can trick the victim to visit a malicious website, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that SOCKS5 proxy is used and that SOCKS5 handshake is slow (e.g. under heavy load or DoS attack).

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud (P/N: WDBCTLxxxxxx-10): All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud Mirror Gen 2: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.30.103

CPE2.3

External links

https://www.westerndigital.com/support/product-security/wdc-25001-western-digital-my-cloud-os-5-firmware-5-30-103

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) External control of file name or path

EUVDB-ID: #VU81863

Risk: Low

CVSSv4.0: 0.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-38546

CWE-ID: CWE-73 - External Control of File Name or Path

Exploit availability: No

Description

The vulnerability allows an attacker to inject arbitrary cookies into request.

The vulnerability exists due to the way cookies are handled by libcurl. If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud (P/N: WDBCTLxxxxxx-10): All versions

My Cloud EX2100: All versions

My Cloud DL4100: All versions

My Cloud Mirror Gen 2: All versions

My Cloud EX4100: All versions

My Cloud EX2 Ultra: All versions

My Cloud PR4100: All versions

My Cloud PR2100: All versions

My Cloud OS 5: before 5.30.103

CPE2.3

External links

https://www.westerndigital.com/support/product-security/wdc-25001-western-digital-my-cloud-os-5-firmware-5-30-103

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.