CVE-2019-9951 - CVE House
Back to Database
Status published Critical CVE-2019-9951

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud...

Vulnerability Description

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9951

Credits & Attribution

No credits recorded in the NVD database.

References

More from western digital

View All →
CVE-2020-8990
Western Digital My Cloud Home before 3.6.0 and ibi before...
Critical 9.1
CVE-2019-18931
Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a...
High 8.8
CVE-2019-18930
Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web...
High 8.8
CVE-2019-18929
Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web...
High 8.8
CVE-2018-17153
It was discovered that the Western Digital My Cloud device...
Critical 9.8

Affected Vendor

western digital

View all reports →

Affected Software

my cloud mirror gen 2 firmware, my cloud ex2 ultra firmware, my cloud ex2100 firmware, my cloud ex4100, my cloud dl2100, my cloud dl4100 firmware, my cloud pr2100 firmware, my cloud pr4100, my cloud firmware
Vulnerable Versions:
0

Timeline

Official Publish: April 24th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.