PT-2020-16190 · Western Digital · Western Digital My Cloud

Abdulla Ismayilov · Published 2020-10-27 · Updated 2021-12-01 · CVE-2020-25765

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Devices versions prior to 5.4.1140

Description The issue is related to a remote code execution vulnerability due to insufficient validation of user input in the reg device.php file. This vulnerability can be exploited, potentially allowing unauthorized access and control.

Recommendations For versions prior to 5.4.1140, update to version 5.4.1140 or later to resolve the issue. As a temporary workaround, consider restricting access to the reg device.php file until a patch is applied. Avoid using the vulnerable reg device.php file in Western Digital My Cloud Devices until the issue is resolved.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

CVE-2020-25765

Affected Products

Western Digital My Cloud

References · 8

• 🔥 https://comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25765 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25765 · Vendor Advisory
• https://westerndigital.com/support/productsecurity · Vendor Advisory
• https://westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114 · Vendor Advisory
• https://t.me/cvenotify/5663 · Telegram Post
• https://t.me/cibsecurity/15668 · Telegram Post
• https://t.me/cvenotify/24011 · Telegram Post