Latest firmware still vulnerable

[cpt_paranoia]

@WD_MCH

Lance, can I suggest that it might be an idea for WD to post a sticky thread on the relevant sub-forums, identifying the status of disclosed CVEs, their exploit risk, and suggested mitigations, and in what firmware CVE vulnerabilities have been closed.

Multiple serious vulnerabilitys including Backdoor etc. as disclosed by gulftech.org

Which begs the questions: a) why are WD not reporting things like that on this forum (or directed emails)? I have enough trouble keeping up with what is posted here, never mind in some random corporate blog b) why do WD not identify the specific CVE vulnerabilities that they have addressed, as part of their firmware release documentation? It’s all rather a shambolic approach to customer communication, isn’t it…?

Multiple serious vulnerabilitys including Backdoor etc. as disclosed by gulftech.org

Likewise. Their track record on communicating and addressing security concerns is very poor, and I doubt it’s going to change any time soon. The only thing that might is if there is a very significant outbreak of actual exploits, and they have to do some serious corporate image reconstruction. Which I hope never happens…

At the moment, all we have to go on is vague statements in the firmware release notes, which rarely identify specific CVEs.