CVE-2019-9950
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials against /etc/shadow. However, the "nobody" account (which can be used to access the control panel API as a low-privilege logged-in user) has a default empty password, allowing an attacker to modify the My Cloud EX2 Ultra web page source code and obtain access to the My Cloud as a non-Admin My Cloud device user.
My Digital, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 y My Cloud PR4100 firmware anterior a 2.31.174, se ve impactado por una vulnerabilidad de omisión de autenticación . El archivo login_mgr.cgi verifica las credenciales contra /etc/shadow. Sin embargo, la cuenta de "nobody" (que se puede usar para acceder a la API del panel de control como un usuario con pocos privilegios de acceso) tiene una contraseña vacía por defecto, lo que permite a un atacante alterar el código fuente de la página web My Cloud EX2 Ultra y conseguir acceso a My Cloud como usuario no administrador de My Cloud.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-23 CVE Reserved
- 2019-04-24 CVE Published
- 2024-04-17 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-521: Weak Password Requirements
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://bnbdr.github.io/posts/wd | X_refsource_misc | |
| https://github.com/bnbdr/wd-rce | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Westerndigital Search vendor "Westerndigital" | My Cloud Firmware Search vendor "Westerndigital" for product "My Cloud Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Search vendor "Westerndigital" for product "My Cloud" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Mirror Gen2 Firmware Search vendor "Westerndigital" for product "My Cloud Mirror Gen2 Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Mirror Gen2 Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Mirror Gen2 Search vendor "Westerndigital" for product "My Cloud Mirror Gen2" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Ex2 Ultra Firmware Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex2 Ultra Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Ex2100 Firmware Search vendor "Westerndigital" for product "My Cloud Ex2100 Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Ex2100 Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex2100 Search vendor "Westerndigital" for product "My Cloud Ex2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Ex4100 Firmware Search vendor "Westerndigital" for product "My Cloud Ex4100 Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Ex4100 Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex4100 Search vendor "Westerndigital" for product "My Cloud Ex4100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Dl2100 Firmware Search vendor "Westerndigital" for product "My Cloud Dl2100 Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Dl2100 Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Dl2100 Search vendor "Westerndigital" for product "My Cloud Dl2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Dl4100 Firmware Search vendor "Westerndigital" for product "My Cloud Dl4100 Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Dl4100 Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Dl4100 Search vendor "Westerndigital" for product "My Cloud Dl4100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Pr2100 Firmware Search vendor "Westerndigital" for product "My Cloud Pr2100 Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Pr2100 Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Pr2100 Search vendor "Westerndigital" for product "My Cloud Pr2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Pr4100 Firmware Search vendor "Westerndigital" for product "My Cloud Pr4100 Firmware" | < 2.31.174 Search vendor "Westerndigital" for product "My Cloud Pr4100 Firmware" and version " < 2.31.174" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Pr4100 Search vendor "Westerndigital" for product "My Cloud Pr4100" | - | - |
Safe
|