Vulnerability Description
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Westerndigital | My Cloud Os 5 | < 5.06.115 |
| Westerndigital | My Cloud Ex2 Ultra | - |
| Westerndigital | My Cloud Ex4100 | - |
| Westerndigital | My Cloud Mirror Gen 2 | - |
| Westerndigital | My Cloud Pr2100 | - |
| Westerndigital | My Cloud Pr4100 | - |
Related Weaknesses (CWE)
References
- https://support.wdc.com/downloads.aspx?g=907&lang=en#downloadsPatchVendor Advisory
- https://www.westerndigital.com/support/productsecurity/wdc-20009-os5-firmware-5-Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-20-1447/Third Party AdvisoryVDB Entry
- https://support.wdc.com/downloads.aspx?g=907&lang=en#downloadsPatchVendor Advisory
- https://www.westerndigital.com/support/productsecurity/wdc-20009-os5-firmware-5-Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-20-1447/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2020-28971?
CVE-2020-28971 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on ...
How severe is CVE-2020-28971?
CVE-2020-28971 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-28971?
Check the references section above for vendor advisories and patch information. Affected products include: Westerndigital My Cloud Os 5, Westerndigital My Cloud Ex2 Ultra, Westerndigital My Cloud Ex4100, Westerndigital My Cloud Mirror Gen 2, Westerndigital My Cloud Pr2100.