Western Digital My Cloud OS Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the user interface of Western Digital My Cloud firmware versions prior to 5.31.108, on NAS platforms. This vulnerability allows remote attackers to execute arbitrary system commands by sending a specially crafted HTTP POST request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected system.

Remediation

Users are advised to update their devices to the latest firmware version 5.31.108. Instructions for updating can be found in the release notes available on the Western Digital support website.