CVE-2016-10108

Critical

Published: 03/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A remote command injection vulnerability as root exists in Western Digital MyCloud NAS version 2.11.142. An attacker can exploit a modified arg parameter in the POST data at the /web/google_analytics.php URL.

Risk Assessment

This vulnerability allows for remote command execution with root privileges, potentially leading to full system compromise. Organizations should be aware of the risks associated with unauthorized access to critical resources.

Recommendation

It is recommended to update the software to the latest version to mitigate this vulnerability. Additionally, access to the NAS interface should be restricted to trusted IP addresses.

Original NVD description (English source)

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.