SB2021070502 - Remote code execution in Western Digital My Cloud PR4100
Published: July 5, 2021
Security Bulletin ID
SB2021070502
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Missing authentication for critical function (CVE-ID: N/A)
The vulnerability allows a remote attacker to compromise the affected device.
The
vulnerability exists due to an error in the configuration when
accessing the management API along with an empty password for the
"nobody" user account. A remote non-authenticated attacker can login under the "nobody" user account
with an empty password to the administrative interface and upload
an arbitrary OS image onto the device.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
Remediation
Install update from vendor's website.