ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2019-9951

—
CVSS 3.0
9.8 critical
EPSS
2%p75
Published
()
Modified
Description

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.

Vendors
western digital
Products
my cloud mirror gen 2 firmware, my cloud ex2 ultra firmware, my cloud ex2100 firmware, my cloud ex4100, my cloud dl2100, my cloud dl4100 firmware, my cloud pr2100 firmware, my cloud pr4100, my cloud firmware
Weakness
CWE-434
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news

No ingested article mentions this CVE yet.