Critical severity · published Sep 29, 2025
CVE-2025-30247
An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system…
9.3
CVSS
1.1%
EPSS
No
On KEV
Description
An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
My Cloud · Western Digital
before 5.31.108 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30247
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30247
www.westerndigital.com
https://www.westerndigital.com/support/product-security/wdc-25006-western-digital-my-cloud-os-5-firmware-5-31-108
More from My Cloud
9.2
CVE-2024-22170
Unchecked buffer in Dynamic DNS client