Vulnerability Details CVE-2021-36224
Western Digital My Cloud devices before OS5 have a nobody account with a blank password.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 24.3%
CVSS Severity
CVSS v3 Score 9.8
References
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
- https://www.youtube.com/watch?v=vsg9YgvGBec
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
- https://www.youtube.com/watch?v=vsg9YgvGBec
Products affected by CVE-2021-36224
-
cpe:2.3:h:westerndigital:my_cloud_pr4100:-
-
cpe:2.3:o:westerndigital:my_cloud_os:-