PT-2019-15721

CVE-2019-18929

Published

2019-11-13

Updated

2019-11-15

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud EX2 Ultra firmware version 2.31.183

Description The issue allows remote execution of arbitrary code via a stack-based buffer overflow in the download mgr.cgi. This can be exploited by web users, including those with guest accounts.

Recommendations For Western Digital My Cloud EX2 Ultra firmware version 2.31.183, consider disabling access to the download mgr.cgi until a patch is available. Restrict access to guest accounts to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Delspon

Jeong Jae Young

Vendors

Affected products

Weakness enumeration

CWE-787: Out-of-bounds Write

Related identifiers