Glad you’re taking security more seriously but you should really have a direct line of communication available with security team. I’ve shared the vuln with your support a while back but the vuln is still alive and well… I can take over my cloud drive with the latest firmware.

We have posted an update in regards to this topic on the Western Digital Blog. https://blog.westerndigital.com/western-digital-cloud-update/ Previously reported security vulnerabilities related to certain My Cloud products had been disclosed by a security researcher directly with our team in 2017,…

@WD_MCH Lance, can I suggest that it might be an idea for WD to post a sticky thread on the relevant sub-forums, identifying the status of disclosed CVEs, their exploit risk, and suggested mitigations, and in what firmware CVE vulnerabilities have been closed. [image] Multiple ser…

@cpt_paranoia Thanks for the suggestion. I will check with the product teams to see if we have more detailed info available.

[image] WD_MCH: I will check with the product teams to see if we have more detailed info available. If WD take product security seriously, they REALLY ought to know the status of EVERY reported CVE relevant to their products. The impression most forum users have gained over the last few year…

Just to add now it has gone mainstream; [image] Locked out? Don’t worry, here’s the hardcoded password for your WD My Cloud... How handy! Oh, it turns out you’re not the only one who can use it to log into your personal files remotely… ■■■■.

The Download link is in the original post copies below for your convenience My Cloud Firmware Update 4.05.00-320 & 2.30.181

The 4.X FW was not updated today. The security issue resolved in this release is not applicable to My Cloud single bay devices running 4.X FW.

Latest firmware still vulnerable

Legacy Products My Cloud OS 3

WD_MCH January 12, 2018, 11:22pm 368

I just wanted to update you all on this issue. We have released a new FW available today for manual download and installation. It will be available for pushed OTA FW update next week. Please see the post below.

Also regarding the hardcoded admin user and password. This issue was resolved in 11/17 FW 2.30.172 release.

Topic		Replies	Views
Endgadet warns about security problem My Cloud OS 3	25	7852	March 20, 2017
Do not buy! My Cloud OS 3	44	8537	April 26, 2020
My ISP reported an issue with My Cloud My Cloud OS 3	32	7034	February 20, 2017
Big access control / security problems with safepoints My Cloud OS 3	22	4686	July 27, 2016
MyCloud Geräte hackbar NAS und Personal Cloud	51	10608	July 13, 2017

Still Need Help?

Reach out to Support for more assistance.

Call Us

Email Us

Sign in to Your Support Account

Get up-to-date information about your products.

Western Digital Business Portal

Unlock benefits and tools for your business such as enterprise support, pricing and rebate tools, marketing, loyalty, rewards, and more.

Visit Business Portal

Latest firmware still vulnerable

Related topics

Still Need Help?

Sign in to Your Support Account

Western Digital Business Portal