// For flags

CVE-2020-28971

Western Digital MyCloud PR4100 nasAdmin Authentication Bypass Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths.

Se detectó un problema en los dispositivos Western Digital My Cloud OS versiones 5 anteriores a 5.06.115. Una vulnerabilidad de omisión de autenticación de administrador de NAS podría permitir a un usuario no autenticado ejecutar comandos privilegiados en el dispositivo por medio de una cookie, debido a una comprobación insuficiente de las rutas del URI

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Western Digital MyCloud PR4100. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the nasAdmin service, which listens on TCP port 80 and 443 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to execute arbitrary code in the context of root.

*Credits: Carlos Su from DEVCORE Security Team
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-11-20 CVE Reserved
  • 2020-12-01 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-09-20 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Westerndigital
Search vendor "Westerndigital"
My Cloud Os 5
Search vendor "Westerndigital" for product "My Cloud Os 5"
< 5.06.115
Search vendor "Westerndigital" for product "My Cloud Os 5" and version " < 5.06.115"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Ex2 Ultra
Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Os 5
Search vendor "Westerndigital" for product "My Cloud Os 5"
< 5.06.115
Search vendor "Westerndigital" for product "My Cloud Os 5" and version " < 5.06.115"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Ex4100
Search vendor "Westerndigital" for product "My Cloud Ex4100"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Os 5
Search vendor "Westerndigital" for product "My Cloud Os 5"
< 5.06.115
Search vendor "Westerndigital" for product "My Cloud Os 5" and version " < 5.06.115"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Mirror Gen 2
Search vendor "Westerndigital" for product "My Cloud Mirror Gen 2"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Os 5
Search vendor "Westerndigital" for product "My Cloud Os 5"
< 5.06.115
Search vendor "Westerndigital" for product "My Cloud Os 5" and version " < 5.06.115"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Pr2100
Search vendor "Westerndigital" for product "My Cloud Pr2100"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Os 5
Search vendor "Westerndigital" for product "My Cloud Os 5"
< 5.06.115
Search vendor "Westerndigital" for product "My Cloud Os 5" and version " < 5.06.115"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Pr4100
Search vendor "Westerndigital" for product "My Cloud Pr4100"
--
Safe