An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST.

Last Modified: Apr 15, 2026

Published: Sep 29, 2025

CVE-2025-57699

Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with the SYSTEM privilege.

Last Modified: Apr 15, 2026

Published: Aug 22, 2025

CVE-2020-8990

Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.

Last Modified: Nov 21, 2024

Published: Feb 20, 2020

CVE-2019-18929

Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest accounts) to remotely execute arbitrary code via a download_mgr.cgi stack-based buffer overflow.

Last Modified: Nov 21, 2024

Published: Nov 13, 2019

CVE-2019-18930

Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest account) to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so, and download_mgr.cgi makes it possible to enter large-sized f_idx inputs.

Last Modified: Nov 21, 2024

Published: Nov 13, 2019

Items Per Page