A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user.
Affected Platforms
Westerndigital My Cloud Ex4100 FirmwareWesterndigital My Cloud Pr2100 FirmwareWesterndigital My Cloud Pr4100Westerndigital My Cloud Pr2100Westerndigital My Cloud Dl4100 FirmwareWesterndigital My Cloud Dl2100Westerndigital My Cloud Dl2100 FirmwareWesterndigital My Cloud Ex2100Westerndigital My Cloud Pr4100 FirmwareWesterndigital My Cloud Mirror G2