PT-2025-39899 · Western Digital · My Cloud

W1Th0Ut · CVE-2025-30247 · Published 2025-09-26 · Updated 2026-06-13

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud versions prior to 5.31.108

Description An OS command injection flaw exists in the user interface of the firmware. This issue allows remote attackers to execute arbitrary system commands by sending a specially crafted HTTP POST request. Approximately 166,900 devices are potentially affected worldwide.

Recommendations Update to version 5.31.108.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-12426

CVE-2025-30247

Affected Products

My Cloud

References · 31

• https://nvd.nist.gov/vuln/detail/CVE-2025-30247 · Security Note
• https://bdu.fstec.ru/vul/2025-12426 · Security Note
• https://twitter.com/f1tym1/status/1973773515925909762 · Twitter Post
• https://twitter.com/zoomeye_team/status/1973369862107045916 · Twitter Post
• https://twitter.com/dailytechonx/status/1973111858291712119 · Twitter Post
• https://twitter.com/gossy_84/status/1973462990235054357 · Twitter Post
• https://twitter.com/CVEnew/status/1972775453929701629 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1972879680790302785 · Twitter Post
• https://twitter.com/Whitehead4Jeff/status/1973119728265863216 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/1973019391785943079 · Twitter Post
• https://twitter.com/ransomnews/status/1973004148674081026 · Twitter Post
• https://twitter.com/UK_Daniel_Card/status/2065921711178985679 · Twitter Post
• https://twitter.com/fridaysecurity/status/1972848910105452623 · Twitter Post
• https://twitter.com/Times_of_Cinema/status/1973020151424471521 · Twitter Post
• https://twitter.com/RedTeamNewsBlog/status/1973073161592688688 · Twitter Post