critical9.8Public exploit code
CVE-2019-16399
Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without creden…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Western Digital My Book World II NAS 1.02.12 - Authentication Bypass / Command Execution2019-09-19 · webapps · hardware
Impact
Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Westerndigital | Wd My Book Firmware | through 1.02.12 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/154524/Western-Digital-My-Book-World-II-NAS-1.02.12-Hardcoded-Credential.html
- https://gist.github.com/pak0s/22ad6bae26198ebcd137b61adb6fcfe6
- http://packetstormsecurity.com/files/154524/Western-Digital-My-Book-World-II-NAS-1.02.12-Hardcoded-Credential.html
- https://gist.github.com/pak0s/22ad6bae26198ebcd137b61adb6fcfe6