CVE Vulnerability

CVE-2019-9951

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://support.wdc.com/downloads.aspx?g=2702&lang=en Third Party Advisory
https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932 Release Notes Third Party Advisory
https://github.com/bnbdr/wd-rce/
https://bnbdr.github.io/posts/wd/
Configurations

Configuration 1
Information

Published : 2019-04-24 06:29

Updated : 2019-05-28 06:29

NVD link : CVE-2019-9951

Mitre link : CVE-2019-9951

Products Affected

My Cloud Mirror Gen 2 Firmware

Western Digital

CWE
CWE-434