CVE-2020-28970 - CVE House
Back to Database
Status published Critical CVE-2020-28970

An issue was discovered on Western Digital My Cloud OS...

Vulnerability Description

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie. (In addition, an upload endpoint could then be used by an authenticated administrator to upload executable PHP scripts.)

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-28970

Credits & Attribution

No credits recorded in the NVD database.

References

More from westerndigital

View All →
CVE-2022-22992
Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.
High 7.8
CVE-2021-3310
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle...
High 7.8
CVE-2021-36226
Western Digital My Cloud devices before OS5 do not use...
Unknown 0
CVE-2021-36225
Western Digital My Cloud devices before OS5 allow REST API...
Unknown 0
CVE-2021-36224
Western Digital My Cloud devices before OS5 have a nobody...
Critical 9.8

Affected Vendor

westerndigital

View all reports →

Affected Software

my cloud os 5
Vulnerable Versions:
0

Timeline

Official Publish: December 1st, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.