Vulnerability Description
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Westerndigital | My Cloud Os | < 5.10.122 |
| Westerndigital | My Cloud Dl2100 | - |
| Westerndigital | My Cloud Dl4100 | - |
| Westerndigital | My Cloud Ex2 Ultra | - |
| Westerndigital | My Cloud Ex2100 | - |
| Westerndigital | My Cloud Ex4100 | - |
| Westerndigital | My Cloud Mirror Gen 2 | - |
| Westerndigital | My Cloud Pr2100 | - |
| Westerndigital | My Cloud Pr4100 | - |
Related Weaknesses (CWE)
References
- https://www.westerndigital.com/support/productsecurity/wdc-21002-my-cloud-firmwaVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-277/Third Party Advisory
- https://www.westerndigital.com/support/productsecurity/wdc-21002-my-cloud-firmwaVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-277/Third Party Advisory
FAQ
What is CVE-2021-3310?
CVE-2021-3310 is a vulnerability with a CVSS score of 7.8 (HIGH). Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).
How severe is CVE-2021-3310?
CVE-2021-3310 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3310?
Check the references section above for vendor advisories and patch information. Affected products include: Westerndigital My Cloud Os, Westerndigital My Cloud Dl2100, Westerndigital My Cloud Dl4100, Westerndigital My Cloud Ex2 Ultra, Westerndigital My Cloud Ex2100.