CVE-2018-18472

—

CVSS 3.0

9.8 critical

EPSS

30%p98

Published

Jun 19, 2019 (Jun 19, 2019)

Modified

Jun 17, 2026

Description

Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,

Vendors: westerndigital
Products: my book live firmware
Weakness: CWE-78
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (30.3%)

In the news4 stories

MyBook Users Urged to Unplug Devices from Internet

Krebs on SecurityJun 25, 20:37 UTC · Jun 25, 2021Exploit / PoC in the wildCVE-2018-18472

Hackers exploit 3-years old flaw to wipe Western Digital devices

Security AffairsJun 25, 18:07 UTC · Jun 25, 2021Exploit / PoC in the wildCVE-2018-18472

WizCase Report: Vulnerabilities found in WD My Book, NetGear Stora, SeaGate Home, Medion LifeCloud NAS

Security AffairsNov 26, 21:19 UTC · Nov 26, 2020Vulnerability CVE-2018-18472 CVE-2018-18471

Western Digital blames 2018 bug for mass

The RecordDec 17, 00:00 UTC · Dec 17, 2022Vulnerability CVE-2018-18472