Improper Authentication in Western Digital products - CVE-2020-28940
Published: December 1, 2020 / Updated: December 16, 2020
Vulnerability identifier: #VU49031
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-28940
CWE-ID: CWE-287
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests within the nasAdmin service. A remote attacker on the local network can bypass authentication process and execute arbitrary commands on the device.
Affected software
My Cloud PR2100
My Cloud PR4100
My Cloud EX2 Ultra
My Cloud EX4100
My Cloud Mirror Gen 2
My Cloud PR4100
My Cloud EX2 Ultra
My Cloud EX4100
My Cloud Mirror Gen 2
How to mitigate CVE-2020-28940
Install updates from vendor's website.
My Cloud PR2100 - update to 5.06.115
My Cloud PR4100 - update to 5.06.115
My Cloud EX2 Ultra - update to 5.06.115
My Cloud EX4100 - update to 5.06.115
My Cloud Mirror Gen 2 - update to 5.06.115
My Cloud PR4100 - update to 5.06.115
My Cloud EX2 Ultra - update to 5.06.115
My Cloud EX4100 - update to 5.06.115
My Cloud Mirror Gen 2 - update to 5.06.115