CVE-2019-9951: Malicious File Upload
First published: Wed Apr 24 2019(Updated: )
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Western Digital My Cloud Mirror Gen 2 Firmware | <2.31.174 | |
| Western Digital My Cloud Mirror Gen 2 | ||
| Western Digital My Cloud EX2 Ultra firmware | <2.31.174 | |
| Western Digital My Cloud EX2 Ultra | ||
| Western Digital My Cloud Ex2100 Firmware | <2.31.174 | |
| Western Digital My Cloud Ex2100 | ||
| Western Digital My Cloud Ex4100 | <2.31.174 | |
| Western Digital My Cloud Ex4100 | ||
| Western Digital My Cloud Dl2100 | <2.31.174 | |
| Western Digital My Cloud Dl2100 | ||
| Western Digital My Cloud Dl4100 Firmware | <2.31.174 | |
| Western Digital My Cloud Dl4100 | ||
| Western Digital My Cloud Pr2100 Firmware | <2.31.174 | |
| Western Digital My Cloud Pr2100 | ||
| Western Digital My Cloud Pr4100 | <2.31.174 | |
| Western Digital My Cloud Pr4100 | ||
| Western Digital My Cloud Firmware | <2.31.174 | |
| Western Digital My Cloud |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Western Digital My Cloud firmware?
The vulnerability ID for the Western Digital My Cloud firmware is CVE-2019-9951.
What is the severity of CVE-2019-9951?
The severity of CVE-2019-9951 is critical with a severity value of 9.8.
Which Western Digital products are affected by CVE-2019-9951?
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100, and My Cloud PR4100 firmware before 2.31.174 are affected.
What is the vulnerability in Western Digital My Cloud firmware?
The vulnerability in Western Digital My Cloud firmware is an unauthenticated file upload vulnerability.
How do I fix CVE-2019-9951?
To fix CVE-2019-9951, update the firmware to version 2.31.174 or later.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/western digital
- canonical/western digital my cloud mirror gen 2 firmware
- canonical/western digital my cloud mirror gen 2
- canonical/western digital my cloud ex2 ultra firmware
- canonical/western digital my cloud ex2 ultra
- canonical/western digital my cloud ex2100 firmware
- canonical/western digital my cloud ex2100
- canonical/western digital my cloud ex4100
- canonical/western digital my cloud dl2100
- canonical/western digital my cloud dl4100 firmware
- canonical/western digital my cloud dl4100
- canonical/western digital my cloud pr2100 firmware
- canonical/western digital my cloud pr2100
- canonical/western digital my cloud pr4100
- canonical/western digital my cloud firmware
- canonical/western digital my cloud