PT-2021-20077 · Western Digital · Western Digital Edgerover

Published 2021-06-11 · Updated 2022-07-12 · CVE-2021-33205

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital EdgeRover versions prior to 0.25

Description The issue allows a low-privileged user to load malicious content into directories with higher privileges due to the usage of Node.js. This enables an attacker to gain admin privileges and perform malicious activities, such as creating a fake library and stealing user credentials.

Recommendations For Western Digital EdgeRover versions prior to 0.25, update to version 0.25 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and limiting the privileges of low-privileged users to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-33205

Affected Products

Western Digital Edgerover

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-33205 · Security Note
• https://westerndigital.com/support/productsecurity/wdc-21007-edgerover-windows-app-ver-0-25 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33205 · Vendor Advisory
• https://t.me/cvenotify/16180 · Telegram Post