Vulnerabilities in WD MyCloud

A security researcher from TrustWave discovered multiple vulnerabilities in the Western Digital (WD) MyCloud network storage devices. 

Several of the findings were summarized by Martin Rakhmanov in the blog post, to include: 

  • Hard-coded administrator credentials in the nas_sharing.cgibinary, that could allow anyone to authenticate to the device with the username “mydlinkBRionyg”. 
  • Issue with nas_sharing.cgi that could allow any user to execute shell commands as root. To exploit this issue the “artist” parameter can be used. 
  • Another issue in nas_sharing.cgi binary that could allow arbitrary file deletion. 

The vulnerabilities were reported to WD in 2017 and since patched per WD release notes