Arbitrary file upload in Western_digital My_cloud
CVE-2019-9951
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upl…
Vulnerability class: Unrestricted File Upload
EPSS: 0.017 (74.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Western_digital My_cloud
- Western_digital My_cloud_dl2100
- Western_digital My_cloud_dl4100
- Western_digital My_cloud_dl4100_firmware
- Western_digital My_cloud_ex2100
- Western_digital My_cloud_ex2100_firmware
- Western_digital My_cloud_ex2_ultra
- Western_digital My_cloud_ex2_ultra_firmware
- Western_digital My_cloud_ex4100
- Western_digital My_cloud_firmware
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Release Notes)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-9951?
- CVE-2019-9951 is a critical-severity vulnerability in Western_digital My_cloud, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2019-04-24.
- How severe is CVE-2019-9951?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-9951 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.