9.8

CVE-2019-9950

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials against /etc/shadow. However, the "nobody" account (which can be used to access the control panel API as a low-privilege logged-in user) has a default empty password, allowing an attacker to modify the My Cloud EX2 Ultra web page source code and obtain access to the My Cloud as a non-Admin My Cloud device user.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Westerndigital ≫ My Cloud Firmware Version < 2.31.174
   Westerndigital ≫ My Cloud Version-
Westerndigital ≫ My Cloud Ex2100 Firmware Version < 2.31.174
   Westerndigital ≫ My Cloud Ex2100 Version-
Westerndigital ≫ My Cloud Ex4100 Firmware Version < 2.31.174
   Westerndigital ≫ My Cloud Ex4100 Version-
Westerndigital ≫ My Cloud Dl2100 Firmware Version < 2.31.174
   Westerndigital ≫ My Cloud Dl2100 Version-
Westerndigital ≫ My Cloud Dl4100 Firmware Version < 2.31.174
   Westerndigital ≫ My Cloud Dl4100 Version-
Westerndigital ≫ My Cloud Pr2100 Firmware Version < 2.31.174
   Westerndigital ≫ My Cloud Pr2100 Version-
Westerndigital ≫ My Cloud Pr4100 Firmware Version < 2.31.174
   Westerndigital ≫ My Cloud Pr4100 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.8% 0.73
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-521 Weak Password Requirements

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.