Security News > 2021 > June > Zero-Day Vulnerability Exploited in Recent Attacks on WD Storage Devices

Western Digital on Tuesday confirmed that the recent attacks targeting some of its older network-attached storage devices involved the exploitation of a zero-day vulnerability.

The attacks came to light last week, with many owners of My Book Live and My Book Live Duo devices reporting on the WD Community forum that a factory reset had been initiated on their devices, which resulted in all files being erased.

WD initially said the attackers exploited CVE-2018-18472, an old flaw that allows a remote attacker who knows the targeted device's IP address to execute arbitrary commands with root privileges.

CVE-2018-18472 has been exploited to install malware on vulnerable NAS devices and CVE-2021-35941 has been leveraged to reset them to factory settings - in some cases both flaws were apparently exploited by the same attacker.

Censys, a company that provides internet visibility and risk assessment products, has also analyzed the attacks and said that CVE-2018-18472 is being exploited to deliver a script that installs and executes malware, causing the compromised device to join a botnet.

The company will also offer a trade-in program to help customers upgrade to newer devices that are not vulnerable to these attacks.

News URL

http://feedproxy.google.com/~r/securityweek/~3/ZjCI3048RfY/zero-day-vulnerability-exploited-recent-attacks-wd-storage-devices