ZDI-23-852: (Pwn2Own) Western Digital MyCloud PR4100 account_mgr Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100 NAS devices. Authentication is not required to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-23-852?
The severity of ZDI-23-852 is critical due to the potential for arbitrary code execution by unauthenticated network-adjacent attackers.
How do I fix ZDI-23-852?
To fix ZDI-23-852, update the firmware of the Western Digital MyCloud PR4100 NAS device to the latest version provided by the vendor.
Who is affected by ZDI-23-852?
ZDI-23-852 affects all users of Western Digital MyCloud PR4100 NAS devices that have not applied the firmware updates addressing this vulnerability.
Can ZDI-23-852 be exploited remotely?
Yes, ZDI-23-852 can be exploited remotely by attackers on the same network segment without authentication.
What type of vulnerability is ZDI-23-852?
ZDI-23-852 is classified as a code execution vulnerability, allowing attackers to execute arbitrary code on the device.