Login Request a demo
Critical severity · published Dec 12, 2017
CVE-2017-17560
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices
9.8
CVSS
73.4%
EPSS
No
On KEV
Description
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)73.4% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MY Cloud Pr4100 Firmware · Westerndigital
2.30.172 · source: NVD
Affected product
MC
MY Cloud Pr4100 Firmware
Westerndigital
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17560
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17560
Exploit
https://download.exploitee.rs/file/generic/Exploiteers-DEFCON25.pdf
Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/9248
Exploit
https://www.exploit-db.com/exploits/43356/
More from MY Cloud Pr4100 Firmware
9.8
CVE-2022-29844
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files
9.8
CVE-2022-29843
A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to…
9.8
CVE-2022-22995
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files
9.8
CVE-2019-9950
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100…
8.8
CVE-2019-9949
Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root,…