PT-2019-15721 · Western Digital · Western Digital My Cloud Ex2 Ultra

Delspon + 1 · Published 2019-11-13 · Updated 2019-11-15 · CVE-2019-18929

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud EX2 Ultra firmware version 2.31.183

Description The issue allows remote execution of arbitrary code via a stack-based buffer overflow in the download mgr.cgi. This can be exploited by web users, including those with guest accounts.

Recommendations For Western Digital My Cloud EX2 Ultra firmware version 2.31.183, consider disabling access to the download mgr.cgi until a patch is available. Restrict access to guest accounts to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-18929

Affected Products

Western Digital My Cloud Ex2 Ultra

References · 4

• 🔥 https://github.com/DelspoN/CVE/blob/master/CVE-2019-18929/description.txt · Exploit
• 🔥 https://github.com/DelspoN/CVE/tree/master/CVE-2019-18929 · Exploit
• https://osv.dev/vulnerability/CVE-2019-18929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18929 · Security Note