Bnbdrwd

The issue allows for code execution as root, starting from a low-privilege user session. This occurs due to the `cgi-bin/webfile mgr.cgi` file permitting arbitrary file write by exploiting symlinks. The vulnerability can be triggered by uploading a tar archive containing a symbolic link, followed by uploading another archive that writes a file to the link using the `cgi untar` command. The `name` parameter passed to the `cgi unzip` command is not sanitized, leading to code execution.

The issue allows for an authentication bypass. It is related to the login mgr.cgi file, which checks credentials against /etc/shadow. However, the `nobody` account has a default empty password. This allows an attacker to access the control panel API as a low-privilege logged-in user, modify the My Cloud EX2 Ultra web page source code, and obtain access to the My Cloud as a non-Admin My Cloud device user.

The issue allows for an unauthenticated file upload, enabling the upload of arbitrary files to any location on the attached storage. This is possible through access to the "web/jquery/uploader/uploadify.php" page without requiring any credentials.