Vulnerability Details CVE-2020-27158
Addressed remote code execution vulnerability in cgi_api.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.107
EPSS Ranking 92.9%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 10.0
References
- https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now/
- https://www.westerndigital.com/support/productsecurity
- https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114
- https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now/
- https://www.westerndigital.com/support/productsecurity
- https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114
Products affected by CVE-2020-27158
-
cpe:2.3:h:westerndigital:my_cloud_ex4100:-
-
cpe:2.3:h:westerndigital:my_cloud_expert_series_ex2:-
-
cpe:2.3:h:westerndigital:my_cloud_mirror_-_gen_2:-
-
cpe:2.3:h:westerndigital:my_cloud_pr2100:-
-
cpe:2.3:h:westerndigital:my_cloud_pr4100:-
-
cpe:2.3:o:westerndigital:my_cloud_firmware:-
-
cpe:2.3:o:westerndigital:my_cloud_firmware:04.05.00-320
-
cpe:2.3:o:westerndigital:my_cloud_firmware:2.31.149
-
cpe:2.3:o:westerndigital:my_cloud_firmware:2.31.163
-
cpe:2.3:o:westerndigital:my_cloud_firmware:2.31.174
-
cpe:2.3:o:westerndigital:my_cloud_firmware:2.31.183