CVE-2020-28970 : What You Need to Know

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. This vulnerability could allow unauthorized users to execute privileged commands on the device.

Understanding CVE-2020-28970

This CVE identifies a NAS Admin authentication bypass vulnerability on Western Digital My Cloud OS 5 devices.

What is CVE-2020-28970?

The CVE-2020-28970 vulnerability allows unauthenticated users to run privileged commands on affected devices using a cookie. Additionally, authenticated administrators could upload executable PHP scripts through an upload endpoint.

The Impact of CVE-2020-28970

The vulnerability poses a significant security risk as it enables unauthorized users to execute commands with elevated privileges on the device, potentially leading to unauthorized access and data compromise.

Technical Details of CVE-2020-28970

This section provides more in-depth technical information about the vulnerability.

Vulnerability Description

The vulnerability in Western Digital My Cloud OS 5 devices before version 5.06.115 allows an authentication bypass for NAS Admin, enabling unauthorized users to execute privileged commands via a cookie. Authenticated administrators can also upload executable PHP scripts.

Affected Systems and Versions

Affected System: Western Digital My Cloud OS 5 devices
Affected Versions: Before 5.06.115

Exploitation Mechanism

The vulnerability can be exploited by unauthenticated users to execute privileged commands using a cookie. Authenticated administrators can leverage the upload endpoint to upload malicious PHP scripts.

Mitigation and Prevention

Protecting systems from CVE-2020-28970 requires immediate action and long-term security measures.

Immediate Steps to Take

Update the affected devices to version 5.06.115 or later to mitigate the vulnerability.
Monitor for any unauthorized access or suspicious activities on the network.

Long-Term Security Practices

Implement strong authentication mechanisms to prevent unauthorized access.
Regularly review and update security configurations to address potential vulnerabilities.

Patching and Updates

Apply security patches and firmware updates promptly to ensure the latest security measures are in place.