CVE-2020-28940: (Pwn2Own) Western Digital MyCloud PR4100 nasAdmin Authentication Bypass Vulnerability
On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticated user to execute privileged commands on the device.
Other sources
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Western Digital MyCloud PR4100. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the nasAdmin service, which listens on TCP port 80 and 443 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to execute arbitrary code in the context of root.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-28940?
CVE-2020-28940 is a vulnerability that allows network-adjacent attackers to bypass authentication on affected installations of Western Digital MyCloud PR4100.
What is the severity of CVE-2020-28940?
CVE-2020-28940 has a severity rating of 9.8 (Critical).
How can the existing authentication mechanism be bypassed in CVE-2020-28940?
The existing authentication mechanism in CVE-2020-28940 can be bypassed by network-adjacent attackers.
Which Western Digital products are affected by CVE-2020-28940?
CVE-2020-28940 affects Western Digital MyCloud PR4100.
Is there a fix available for CVE-2020-28940?
Yes, Western Digital has released a firmware update (version 5.06.115) to address CVE-2020-28940. Users should update their firmware to the latest version.