Remote Access Vulnerability

[tempaccount]

This is also discussed for other models here:

'I am admin' bug turns WD's My Cloud boxes into Everyone's Cloud

Subject borrowed from El Reg: More details here: Tested versions This vulnerability was successfully verified on a Western Digital My Cloud model WDBCTL0020HWT running firmware version 2.30.172. This issue is not limited to the model that was used to find this vulnerability since most of the products in the My Cloud series share the same (vulnerable) code. Fix There is currently no fix available. Thoughts?

A “statement” of WD is available at:

https://blog.westerndigital.com/western-digital-my-cloud-update/

My Cloud "Authentication Bypass" 09/21/2018

Update 9/21/18: The issue stated below concerning an authentication bypass vulnerability has been addressed with a hotfix that can be immediately downloaded here: https://support.wdc.com/knowledgebase/answer.aspx?ID=25952&s The original information appears below. https://blog.westerndigital.com/western-digital-my-cloud-update/ Recently, security researcher Securify published an authentication bypass vulnerability for our My Cloud products (My Cloud Home is exempt from the vulnerability)…