Improper Authentication in Western Digital products - CVE-2020-29563
Published: December 12, 2020 / Updated: December 16, 2020
Vulnerability identifier: #VU49038
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-29563
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests within the mod_rewrite module. A remote attacker can bypass authentication process and gain unauthorized access to the application.
Affected software
My Cloud PR2100
My Cloud PR4100
My Cloud EX2 Ultra
My Cloud EX4100
My Cloud Mirror Gen 2
My Cloud PR4100
My Cloud EX2 Ultra
My Cloud EX4100
My Cloud Mirror Gen 2
How to mitigate CVE-2020-29563
Install updates from vendor's website.
My Cloud PR2100 - update to 5.07.118
My Cloud PR4100 - update to 5.07.118
My Cloud EX2 Ultra - update to 5.07.118
My Cloud EX4100 - update to 5.07.118
My Cloud Mirror Gen 2 - update to 5.07.118
My Cloud PR4100 - update to 5.07.118
My Cloud EX2 Ultra - update to 5.07.118
My Cloud EX4100 - update to 5.07.118
My Cloud Mirror Gen 2 - update to 5.07.118