published December 1, 2020
🚨 An unauthenticated user can take privileged actions on your Western Digital My Cloud OS 5 devices with a simple cookie! 🍪 Think of it like a restaurant where the staff forgets to check the ID of someone trying to access the kitchen. With no verification, anyone can stroll in and start cooking up trouble in the back! This could lead to an attacker running malicious commands on your NAS, potentially compromising sensitive data or even uploading harmful scripts that could wreak havoc on your system. Imagine someone rearranging the entire menu without permission, leaving you with a disaster on your hands!
Think of it like a restaurant where the staff forgets to check the ID of someone trying to access the kitchen. With no verification, anyone can stroll in and start cooking up trouble in the back! CVE-2020-28970 is an authentication bypass vulnerability in Western Digital My Cloud OS 5 devices, allowing an unauthenticated user to execute privileged commands through a cookie. An additional endpoint could let an authenticated admin upload executable PHP scripts, escalating the risk.
This could lead to an attacker running malicious commands on your NAS, potentially compromising sensitive data or even uploading harmful scripts that could wreak havoc on your system. Imagine someone rearranging the entire menu without permission, leaving you with a disaster on your hands! Update your Western Digital My Cloud OS 5 devices to version 5.06.115 or later immediately. Review any existing cookie management and ensure proper authentication checks are in place to prevent unauthorized access. Regularly audit upload endpoints to mitigate similar risks. You've got this! Fixing this vulnerability will help keep your data safe and secure. 🛡️