Quisque Aliquam

[dswv42]

Pellentesque imperdiet venenatis ullamcorper. Quisque condimentum metus a auctor porta. Quisque aliquam eleifend diam a gravida. Cras elementum risus et velit lobortis efficitur.

[Tfl]

Thanks for the overview.
The command injection is post auth, but it can be any user without admin rights, correct?

[WD_MCH]

Latest firmware still vulnerable

We have posted an update in regards to this topic on the Western Digital Blog. https://blog.westerndigital.com/western-digital-cloud-update/ Previously reported security vulnerabilities related to certain My Cloud products had been disclosed by a security researcher directly with our team in 2017, and critical issues mentioned in these recent articles (gulftech.org; thehackernews.com) were addressed in 2017 with firmware update v2.30.172 and above. Other issues are being addressed in future up…

[WD_MCH]

I just wanted to update you all on this issue. We have released a new FW available today for manual download and installation. It will be available for pushed OTA FW update next week. Please see the post below.

New Release - WD Pro Series Firmware Version 2.30.181 (01/12/18)

WD is pleased to announce the release of WD Pro Series Firmware Update 2.30.181 for the My Cloud PR2100 and My Cloud PR4100. 2.30.181 Release Notes Resolved Issues: Resolved security vulnerability (CVE-2017-17560) - Unauthorized access to multipart upload functionality. 2.03.172 Release Notes Resolved Issues: Resolved SMB server (samba) security vulnerability (CVE-2017-7494) - Malicious clients can upload and cause the SMB server to execute a shared library from a writable share. Resolve…