PT-2016-3231 · Western Digital · Western Digital My Cloud

Published 2016-12-29 · Updated 2023-07-28 · CVE-2016-10108

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Western Digital MyCloud NAS version 2.11.142

Description The issue is related to unauthenticated remote command injection as root in the Western Digital MyCloud NAS. This occurs via a modified arg parameter in the POST data to the "/web/google analytics.php" URL. The vulnerability is associated with a lack of data sanitization at the management level, allowing an attacker to inject arbitrary commands remotely using a specially crafted arg parameter sent via the POST method.

Recommendations For Western Digital MyCloud NAS version 2.11.142, as a temporary workaround, consider restricting access to the "/web/google analytics.php" URL to minimize the risk of exploitation. Avoid using the arg parameter in the affected URL until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2017-02626

CVE-2016-10108

Affected Products

Western Digital My Cloud

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/wd_mycloud_unauthenticated_cmd_injection.rb · Exploit
• 🔥 https://stevencampbell.info/2016/12/command-injection-in-western-digital-mycloud-nas · Exploit
• https://bdu.fstec.ru/vul/2017-02626 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-10108 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10108 · Vendor Advisory
• https://support.wdc.com/downloads.aspx?g=904&lang=ru#downloads · Note
• http://packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.html · Note
• http://securityfocus.com/bid/95200 · Note
• https://support.wdc.com/downloads.aspx?g=904&lang=ru#downloads · Note