Auth bypass in Western_digital My_cloud_dl2100
CVE-2018-17153
It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing t…
Vulnerability class: Broken Authentication
EPSS: 0.866 (99.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Western_digital My_cloud_dl2100
- Western_digital My_cloud_dl4100
- Western_digital My_cloud_dl4100_firmware
- Western_digital My_cloud_ex2
- Western_digital My_cloud_ex2100
- Western_digital My_cloud_ex2100_firmware
- Western_digital My_cloud_ex2_firmware
- Western_digital My_cloud_ex2_ultra
- Western_digital My_cloud_ex2_ultra_firmware
- Western_digital My_cloud_ex4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry)
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org
Frequently asked questions
- What is CVE-2018-17153?
- CVE-2018-17153 is a critical-severity vulnerability in Western_digital My_cloud_dl2100, classified under Improper Authentication. CVSS score: 9.8/10. Published 2018-09-18.
- How severe is CVE-2018-17153?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2018-17153 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.