Westerndigital vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-36226 Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.Critical 9.8 · Feb 6, 2023
• CVE-2021-36225 Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installatHigh 8.8 · Feb 6, 2023
• CVE-2021-36224 Western Digital My Cloud devices before OS5 have a nobody account with a blank password.Critical 9.8 · Feb 6, 2023
• CVE-2022-22992 A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary sysHigh 7.8 · Jan 28, 2022
• CVE-2021-35941 Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory restore withoHigh 7.5 · Jun 29, 2021
• CVE-2021-33205 Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories wiHigh 8.8 · Jun 11, 2021
• CVE-2021-3310 Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares.High 7.8 · Mar 10, 2021
• CVE-2020-29654 Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account.High 7.8 · Dec 11, 2020
• CVE-2020-29563 An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118.Critical 9.8 · Dec 11, 2020
• CVE-2020-28971 An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115.Critical 9.8 · Dec 1, 2020
• CVE-2020-28970 An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115.Critical 9.8 · Dec 1, 2020
• CVE-2020-28940 On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticatedCritical 9.8 · Dec 1, 2020
• CVE-2020-27744 An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114.Critical 9.8 · Oct 29, 2020
• CVE-2020-27160 Addressed remote code execution vulnerability in AvailableApps.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.1Critical 9.8 · Oct 27, 2020
• CVE-2020-27159 Addressed remote code execution vulnerability in DsdkProxy.php due to insufficient sanitization and insufficient validation of user input in Western Digital My Critical 9.8 · Oct 27, 2020
• CVE-2020-27158 Addressed remote code execution vulnerability in cgi_api.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114.Critical 9.8 · Oct 27, 2020
• CVE-2020-25765 Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.11Critical 9.8 · Oct 27, 2020
• CVE-2020-12830 Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code exeCritical 9.8 · Oct 27, 2020
• CVE-2020-15816 In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the applicatiHigh 8.8 · Jul 17, 2020
• CVE-2020-12427 The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modHigh 8.8 · May 13, 2020
• CVE-2019-10705 Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data to be decrypted withHigh 7.5 · Mar 10, 2020
• CVE-2020-8959 Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking.High 7.8 · Feb 19, 2020
• CVE-2019-16399 Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentCritical 9.8 · Sep 18, 2019
• CVE-2018-18472 Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/laCritical 9.8 · Jun 19, 2019
• CVE-2019-9949 Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code executHigh 8.8 · May 23, 2019