CVE-2018-18472 - CVE House
Back to Database
Status published Critical CVE-2018-18472

Western Digital WD My Book Live and WD My Book...

Vulnerability Description

Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18472

Credits & Attribution

No credits recorded in the NVD database.

References

More from westerndigital

View All →
CVE-2022-22992
Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.
High 7.8
CVE-2021-3310
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle...
High 7.8
CVE-2021-36226
Western Digital My Cloud devices before OS5 do not use...
Unknown 0
CVE-2021-36225
Western Digital My Cloud devices before OS5 allow REST API...
Unknown 0
CVE-2021-36224
Western Digital My Cloud devices before OS5 have a nobody...
Critical 9.8

Affected Vendor

westerndigital

View all reports →

Affected Software

my book live firmware
Vulnerable Versions:
Unknown

Timeline

Official Publish: June 19th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.