high8.8
CVE-2021-36225
Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installa…
Impact
Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Westerndigital | My Cloud Os | before 5.02.104 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
- https://www.youtube.com/watch?v=vsg9YgvGBec
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
- https://www.youtube.com/watch?v=vsg9YgvGBec