PT-2020-17066 · Western Digital · Western Digital My Cloud Os 5

Lays · Published 2020-12-01 · Updated 2022-04-26 · CVE-2020-28940

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud OS 5 versions prior to 5.06.115

Description The NAS Admin dashboard has an authentication bypass issue that could allow an unauthenticated user to execute privileged commands on the device. This could potentially lead to unauthorized access and control of the device.

Recommendations For Western Digital My Cloud OS 5 versions prior to 5.06.115, update to version 5.06.115 or later to resolve the issue. As a temporary workaround, consider restricting access to the NAS Admin dashboard until the update can be applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-28940

ZDI-20-1445

Affected Products

Western Digital My Cloud Os 5

References · 7

• https://zerodayinitiative.com/advisories/ZDI-20-1445 · Security Note
• https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads · Vendor Advisory
• https://westerndigital.com/support/productsecurity/wdc-20009-os5-firmware-5-06-115 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28940 · Security Note
• https://t.me/cibsecurity/16986 · Telegram Post
• https://t.me/cvenotify/6400 · Telegram Post