published December 12, 2017
NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.
🚨 An unguarded door to your device! The Western Digital MyCloud PR4100 allows anyone to upload files without authentication, putting your data at serious risk! 🔥 Think of it like a hotel with an open back door. Anyone can stroll in, drop off their luggage, or worse, set up camp without ever checking in at the front desk! This vulnerability could let an attacker upload a malicious PHP shell, allowing them to execute arbitrary code as root. It’s like handing over the master key to your hotel's safe—anyone could access sensitive information and disrupt your entire operation!
Think of it like a hotel with an open back door. Anyone can stroll in, drop off their luggage, or worse, set up camp without ever checking in at the front desk! The flaw lies in the web administration component, specifically in /web/jquery/uploader/multi_uploadify.php, where multipart uploads can occur without authentication checks. This means an attacker can place files anywhere on the device and gain elevated privileges with ease.
This vulnerability could let an attacker upload a malicious PHP shell, allowing them to execute arbitrary code as root. It’s like handing over the master key to your hotel's safe—anyone could access sensitive information and disrupt your entire operation! To protect your device, immediately restrict access to the vulnerable multiparty upload functionality or disable it if not needed. Ensure your firmware is up to date, and consider implementing additional authentication measures to secure your device further. You’ve got this! By taking these steps, you're well on your way to locking down your device for good! 🛡️