Attacker Value
Very High
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
1

CVE-2018-18472

Disclosure Date: June 19, 2019 •
CVE-2018-18472 CVSS v3 Base Score: 9.8
Exploited in the Wild
Reported by gwillcox-r7
View Source Details
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,

Add Assessment

1
Ratings
  • Attacker Value
    Very High
  • Exploitability
    Medium
Difficult to patchEasy to weaponizeGives privileged accessUnauthenticatedVulnerable in default configuration
Technical Analysis

An unauthenticated command injection bug in WD My Book Live and WD My Book Live Duo devices that gives root level access to the device and all the data stored on it. This has been actively exploited in the wild and there is no plan from the manufacture to fix this bug since it only affects WD My Book Live devices which they state where introduced to the market in 2010 and recieved their final update in 2015. Your best bet is to migrate your data and then get rid of this device somehow.

It is also important to note that this auth bypass occurs due to a refactoring of the authentication code where appropriate access checks were not applied. You can read more on this at https://www.westerndigital.com/support/product-security/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo

Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
n/a
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • westerndigital

Products

  • my book live firmware
Technical Analysis