Vulnerabilities > Westerndigital

DATE CVE VULNERABILITY TITLE RISK
2020-12-12 CVE-2020-29563 Improper Authentication vulnerability in Westerndigital MY Cloud OS 5
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118.
network
low complexity
westerndigital CWE-287
critical
 9.8
9.8
2020-12-01 CVE-2020-28971 Improper Authentication vulnerability in Westerndigital MY Cloud OS 5
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115.
network
low complexity
westerndigital CWE-287
critical
 9.8
9.8
2020-12-01 CVE-2020-28970 Improper Authentication vulnerability in Westerndigital MY Cloud OS 5
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115.
network
low complexity
westerndigital CWE-287
critical
 9.8
9.8
2020-12-01 CVE-2020-28940 Improper Authentication vulnerability in Westerndigital MY Cloud OS 5
On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticated user to execute privileged commands on the device.
network
low complexity
westerndigital CWE-287
critical
 9.8
9.8
2020-11-18 CVE-2020-13799 Authentication Bypass by Capture-replay vulnerability in multiple products
Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe.
low complexity
westerndigital linaro CWE-294
6.8
6.8
2020-10-29 CVE-2020-27744 OS Command Injection vulnerability in Westerndigital MY Cloud Firmware
An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114.
network
low complexity
westerndigital CWE-78
critical
 9.8
9.8
2020-10-27 CVE-2020-27160 Path Traversal vulnerability in Westerndigital MY Cloud Firmware
Addressed remote code execution vulnerability in AvailableApps.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114 (issue 3 of 3).
network
low complexity
westerndigital CWE-22
critical
 9.8
9.8
2020-10-27 CVE-2020-27159 OS Command Injection vulnerability in Westerndigital MY Cloud Firmware
Addressed remote code execution vulnerability in DsdkProxy.php due to insufficient sanitization and insufficient validation of user input in Western Digital My Cloud NAS devices prior to 5.04.114
network
low complexity
westerndigital CWE-78
critical
 9.8
9.8
2020-10-27 CVE-2020-27158 OS Command Injection vulnerability in Westerndigital MY Cloud Firmware
Addressed remote code execution vulnerability in cgi_api.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114.
network
low complexity
westerndigital CWE-78
critical
 9.8
9.8
2020-10-27 CVE-2020-25765 OS Command Injection vulnerability in Westerndigital MY Cloud Firmware
Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.1140.
network
low complexity
westerndigital CWE-78
critical
 9.8
9.8