Threat Investigation
Request a demo

CVE-2019-9949

High

Description

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root, starting from a low-privilege user session) vulnerability. The cgi-bin/webfile_mgr.cgi file allows arbitrary file write by abusing symlinks. Specifically, this occurs by uploading a tar archive that contains a symbolic link, then uploading another archive that writes a file to the link using the "cgi_untar" command. Other commands might also be susceptible. Code can be executed because the "name" parameter passed to the cgi_unzip command is not sanitized.

SeverityHigh
CVSS8.8
Exploit probability—
ProductWesterndigital My Cloud Firmware
PublishedMay 23, 2019
First seenMay 23, 2019

How to fix

Update
  • westerndigital my_cloud_firmware2.31.183 or later
  • westerndigital my_cloud_mirror_gen2_firmware2.31.183 or later
  • westerndigital my_cloud_ex2_ultra_firmware2.31.183 or later
  • westerndigital my_cloud_ex2100_firmware2.31.183 or later
  • westerndigital my_cloud_ex4100_firmware2.31.183 or later
  • westerndigital my_cloud_dl2100_firmware2.31.183 or later
  • westerndigital my_cloud_dl4100_firmware2.31.183 or later
  • westerndigital my_cloud_pr2100_firmware2.31.183 or later
  • westerndigital my_cloud_pr4100_firmware2.31.183 or later

Affected products

ProductAffected versionsFixed in
westerndigital my_cloud_firmwarev < 2.31.1832.31.183
westerndigital my_cloud_mirror_gen2_firmwarev < 2.31.1832.31.183
westerndigital my_cloud_ex2_ultra_firmwarev < 2.31.1832.31.183
westerndigital my_cloud_ex2100_firmwarev < 2.31.1832.31.183
westerndigital my_cloud_ex4100_firmwarev < 2.31.1832.31.183
westerndigital my_cloud_dl2100_firmwarev < 2.31.1832.31.183
westerndigital my_cloud_dl4100_firmwarev < 2.31.1832.31.183
westerndigital my_cloud_pr2100_firmwarev < 2.31.1832.31.183
westerndigital my_cloud_pr4100_firmwarev < 2.31.1832.31.183

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.