PT-2019-19954 · Western Digital · My Cloud Ex2100+8

Bnbdrwd · Published 2019-04-24 · Updated 2020-08-24 · CVE-2019-9950

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 versions prior to 2.31.174

Description The issue allows for an authentication bypass. It is related to the login mgr.cgi file, which checks credentials against /etc/shadow. However, the nobody account has a default empty password. This allows an attacker to access the control panel API as a low-privilege logged-in user, modify the My Cloud EX2 Ultra web page source code, and obtain access to the My Cloud as a non-Admin My Cloud device user.

Recommendations For versions prior to 2.31.174, update the firmware to version 2.31.174 or later to resolve the issue. As a temporary workaround, consider changing the default empty password of the nobody account to prevent unauthorized access. Restrict access to the control panel API to minimize the risk of exploitation. Avoid using the default nobody account for accessing the control panel API until the issue is resolved.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2019-9950

Affected Products

My Cloud

My Cloud Dl2100

My Cloud Dl4100

My Cloud Ex2 Ultra

My Cloud Ex2100

My Cloud Ex4100

My Cloud Mirror Gen2

My Cloud Pr2100

My Cloud Pr4100

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-9950 · Security Note
• https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932 · Vendor Advisory
• https://support.wdc.com/downloads.aspx?g=2702&lang=en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9950 · Vendor Advisory
• https://bnbdr.github.io/posts/wd · Note
• https://github.com/bnbdr/wd-rce · Note