Back to Database
Status published
Critical
CVE-2025-30247
An OS command injection vulnerability in user interface in Western...
Vulnerability Description
An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-30247
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Western Digital would like to thank w1th0ut for reporting this
More from Western Digital
View All →CVE-2025-30248
DLL hijacking in the WD Discovery Installer in Western Digital...
High
8.9
CVE-2024-22170
Unchecked buffer in Dynamic DNS client
Critical
9.2
CVE-2024-22169
Misconfiguration in node.js causing a code execution in WD Discovery
High
7.1
CVE-2024-22168
Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps
Medium
5.9
CVE-2023-22819
Uncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products
Medium
4.9
Affected Vendor
Western Digital
View all reports →Affected Software
My Cloud
Vulnerable Versions:
0
Timeline
Official Publish:
September 29th, 2025
Last Modified:
September 30th, 2025
Added to House:
July 22nd, 2026