CVE-2025-30247CWE-78command-injection

CVE-2025-30247

published September 30, 2025

CVSS
9.3
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.01089 · 65.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-09-30T01:15Z
References (1)
https://www.westerndigital.com/support/product-security/wdc-25006-western-digital-my-cloud-os-5-firmware-5-31-108 · [email protected]
EPSS history
Timeline
  • 29 SEP 21:07Z
    An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to…
    cvelistv5