My Cloud Os
CVE-2021-3310
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).
AnalysisAI
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-59. Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files). Affected products include: Westerndigital My Cloud Os. Version information: before 5.10.122.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in My Cloud Os
View allAn authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that
Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an
Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices
Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devic
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today