ZDI-24-1294: Western Digital MyCloud PR4100 ddns-start Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-22170.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-1294?
The vulnerability ZDI-24-1294 has a CVSS rating of 7.5, indicating it is highly severe.
How do I fix ZDI-24-1294?
To mitigate the effects of ZDI-24-1294, it is recommended to update your Western Digital MyCloud PR4100 to the latest firmware version.
Who is affected by ZDI-24-1294?
The vulnerability ZDI-24-1294 affects all installations of Western Digital MyCloud PR4100 without requiring authentication.
What type of attack does ZDI-24-1294 enable?
ZDI-24-1294 allows network-adjacent attackers to execute arbitrary code on the affected devices.
Is authentication required to exploit ZDI-24-1294?
No, authentication is not required to exploit the vulnerability ZDI-24-1294.