CVE-2021-36224

Western Digital My Cloud devices before OS5 have a nobody account with a blank password

published February 6, 2023

CVSS
—
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

⚠️ A nobody account with a blank password leaves your Western Digital My Cloud devices wide open! 🔓 Think of it as leaving the back door of your house unlocked with a sign that says ‘welcome’ — it’s just asking for trouble! Anyone passing by can waltz in and rummage through your stuff without breaking a sweat. With this vulnerability, an attacker can easily access your files and sensitive data stored on the device. It's like giving a stranger the keys to your digital storage, potentially leading to data loss or misuse. This could be absolutely devastating for anyone relying on these devices for security and backup.

Put simply

Think of it as leaving the back door of your house unlocked with a sign that says ‘welcome’ — it’s just asking for trouble! Anyone passing by can waltz in and rummage through your stuff without breaking a sweat. The vulnerability stems from a default account named 'nobody' that has no password set, allowing unauthorized access to the device for users who know how to find it.

What to do

With this vulnerability, an attacker can easily access your files and sensitive data stored on the device. It's like giving a stranger the keys to your digital storage, potentially leading to data loss or misuse. This could be absolutely devastating for anyone relying on these devices for security and backup. To protect your data, change the default settings immediately. If you haven’t upgraded your device yet, consider installing OS5, which addresses this issue. Also, ensure that any unnecessary accounts are disabled or deleted to minimize exposure. You've got this! By taking these steps, you can lock down your devices and keep your data safe. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01185 · 67.6th percentile
Published
2023-02-06T00:00Z
EPSS history
Timeline
  • 06 FEB 00:00Z
    Western Digital My Cloud devices before OS5 have a nobody account with a blank password
    cvelistv5