CVE-2019-9951

Published: Apr 24, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.

Affected (9)

Products: Western Digital: My Cloud Mirror Gen 2 Firmware, My Cloud Ex2 Ultra Firmware, My Cloud Ex2100 Firmware, My Cloud Ex4100, My Cloud Dl2100, My Cloud Dl4100 Firmware, My Cloud Pr2100 Firmware, My Cloud Pr4100, My Cloud Firmware

Western Digital

9 products

My Cloud Mirror Gen 2 Firmware

My Cloud Ex2 Ultra Firmware

My Cloud Ex2100 Firmware

My Cloud Ex4100

My Cloud Dl2100

My Cloud Dl4100 Firmware

My Cloud Pr2100 Firmware

My Cloud Pr4100

My Cloud Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Mirror Gen 2 Firmware	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud Mirror Gen 2	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Ex2 Ultra Firmware	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud Ex2 Ultra	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Ex2100 Firmware	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud Ex2100	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Ex4100	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud Ex4100	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Dl2100	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud Dl2100	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Dl4100 Firmware	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud Dl4100	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Pr2100 Firmware	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud Pr2100	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Pr4100	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud Pr4100	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Western Digital My Cloud Firmware	Before 2.31.174

Running on/with	Platform Versions
Western Digital My Cloud	All versions

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (8)

https://bnbdr.github.io/posts/wd/

Source: cve@mitre.org

https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/bnbdr/wd-rce/

Source: cve@mitre.org

https://support.wdc.com/downloads.aspx?g=2702&lang=en

Source: cve@mitre.org

Third Party Advisory

https://bnbdr.github.io/posts/wd/

Source: af854a3a-2127-422b-91ae-364da2661108

https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://github.com/bnbdr/wd-rce/

Source: af854a3a-2127-422b-91ae-364da2661108

https://support.wdc.com/downloads.aspx?g=2702&lang=en

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.