PT-2021-2435 · Western Digital · Western Digital My Cloud

Chris Hernandez · Published 2021-01-05 · Updated 2021-05-25 · CVE-2021-3310

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud OS 5 versions prior to 5.10.122

Description: The issue is related to the mishandling of Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure by reading local files. The vulnerability is associated with incorrect processing of symbolic links in the implementation of network protocols SMB and AFP in My Cloud OS.

Recommendations: For Western Digital My Cloud OS 5 versions prior to 5.10.122, update to version 5.10.122 or later to resolve the issue. As a temporary workaround, consider restricting access to SMB and AFP shares to minimize the risk of exploitation. Avoid using SMB and AFP shares until the issue is resolved.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2021-01691

CVE-2021-3310

ZDI-21-277

Affected Products

Western Digital My Cloud

References · 10

• 🔥 https://github.com/piffd0s/CVE-2021-3310 · Exploit
• https://westerndigital.com/support/productsecurity/wdc-21002-my-cloud-firmware-version-5-10-122 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3310 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-277 · Security Note
• https://bdu.fstec.ru/vul/2021-01691 · Security Note
• https://t.me/cvenotify/11209 · Telegram Post
• https://t.me/cvenotify/11061 · Telegram Post
• https://t.me/cybersecuritytechnologies/3454 · Telegram Post
• https://t.me/cibsecurity/24668 · Telegram Post