CVE-2017-17560
CriticalSummary
An issue was discovered on Western Digital MyCloud PR4100 devices running version 2.30.172. The web administration component allows multipart uploads without authentication, enabling an attacker to upload a PHP shell to the device's file system.
Risk Assessment
An attacker can gain root access to the system, posing a significant threat to data security and system integrity.
Recommendation
It is recommended to block access to the /web/jquery/uploader/multi_uploadify.php component and implement appropriate authentication mechanisms.
Original NVD description (English source)
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.