CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2019-9950
https://notcve.org/view.php?id=CVE-2019-9950
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials against /etc/shadow. However, the "nobody" account (which can be used to access the control panel API as a low-privilege logged-in user) has a default empty password, allowing an attacker to modify the My Cloud EX2 Ultra web page source code and obtain access to the My Cloud as a non-Admin My Cloud device user. My Digital, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 y My Cloud PR4100 firmware anterior a 2.31.174, se ve impactado por una vulnerabilidad de omisión de autenticación . El archivo login_mgr.cgi verifica las credenciales contra /etc/shadow. • https://bnbdr.github.io/posts/wd https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932 https://github.com/bnbdr/wd-rce https://support.wdc.com/downloads.aspx?g=2702&lang=en • CWE-521: Weak Password Requirements •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 1CVE-2018-9148
https://notcve.org/view.php?id=CVE-2018-9148
Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a product that uses My Cloud. Los dispositivos Western Digital WD My Cloud v04.05.00-320 incrustan el token de sesión (también conocido como PHPSESSID) en los nombres de los archivos, lo que hace que sea más fácil para los atacantes omitir la autenticación al listar un directorio. NOTA: esto se puede explotar junto con CVE-2018-7171 para omitir la autenticación remota en un producto que utiliza My Cloud. • https://exploit-db.com/exploits/44350 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 97%CPEs: 2EXPL: 2CVE-2017-17560 – Western Digital MyCloud - 'multi_uploadify' File Upload
https://notcve.org/view.php?id=CVE-2017-17560
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root. Se ha descubierto un error en los dispositivos Western Digital MyCloud PR4100 2.30.172. El componente de administración web, /web/jquery/uploader/multi_uploadify.php, proporciona una funcionalidad de subida multiparte accesible sin autenticación. • https://www.exploit-db.com/exploits/43356 https://download.exploitee.rs/file/generic/Exploiteers-DEFCON25.pdf https://github.com/rapid7/metasploit-framework/pull/9248 https://www.exploitee.rs/index.php/Western_Digital_MyCloud#.2Fjquery.2Fuploader.2Fmulti_uploadify.php_.28added_08.2F06.2F2017.29 https://www.youtube.com/watch?v=EO_49pfmA5A • CWE-287: Improper Authentication •