N/A

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admin in the HTTP request. The invoked CGI will check if a valid session is present and bound to the user's IP address.) It was found that it is possible for an unauthenticated attacker to create a valid session without a login. The network_mgr.cgi CGI module contains a command called "cgi_get_ipv6" that starts an admin session -- tied to the IP address of the user making the request -- if the additional parameter "flag" with the value "1" is provided. Subsequent invocation of commands that would normally require admin privileges now succeed if an attacker sets the username=admin cookie.

N/A

N/A

Western Digital My Cloud 安全漏洞

Western Digital My Cloud是美国西部数据（Western Digital）公司的一款个人网络云存储设备。 Western Digital My Cloud 2.30.x及之前版本中存在身份验证绕过漏洞。攻击者可利用该漏洞无需密码以admin用户身份通过身份验证或无需登录便可创建有效的会话。

N/A

N/A