PT-2019-15722 · Western Digital · Libscheddl.So+1

Delspon + 1 · Publicado 2019-11-13 · Atualizado 2019-11-15 · CVE-2019-18930

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud EX2 Ultra firmware version 2.31.183

Description The issue allows remote execution of arbitrary code via a stack-based buffer overflow. This is possible due to the lack of size verification logic in one of the functions in libscheddl.so. The download mgr.cgi endpoint makes it possible to enter large-sized f idx inputs, which can be exploited.

Recommendations For Western Digital My Cloud EX2 Ultra firmware version 2.31.183, consider disabling the download mgr.cgi endpoint until a patch is available to prevent exploitation. Additionally, restricting access to the libscheddl.so library may help minimize the risk.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-18930

Produtos afetados

Western Digital My Cloud Ex2 Ultra

Libscheddl.So

Referências · 4

• 🔥 https://github.com/DelspoN/CVE/blob/master/CVE-2019-18930/description.txt · Exploit
• 🔥 https://github.com/DelspoN/CVE/tree/master/CVE-2019-18930 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18930 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18930 · Aviso do Fabricante