ZDI-CAN-20003: ZDI-23-852: (Pwn2Own) Western Digital MyCloud PR4100 account_mgr Command Injection Remote Code Execution Vulnerability
Published Jun 8, 2023
·Updated
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100 NAS devices. Authentication is not required to exploit this vulnerability.
Affected Software
1 affected component
Western Digital MyCloud PR4100
Event History
Jun 8, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-20003?
The severity of ZDI-CAN-20003 is high, as it allows arbitrary code execution without authentication.
2
How do I fix ZDI-CAN-20003?
To fix ZDI-CAN-20003, apply the latest firmware update provided by Western Digital for the MyCloud PR4100.
3
Who is affected by ZDI-CAN-20003?
ZDI-CAN-20003 affects installations of Western Digital MyCloud PR4100 NAS devices.
4
What kind of attacks can be executed using ZDI-CAN-20003?
ZDI-CAN-20003 allows network-adjacent attackers to execute arbitrary code on the affected devices.
5
Is authentication required to exploit ZDI-CAN-20003?
No, authentication is not required to exploit ZDI-CAN-20003.