CVE-2017-17560: westerndigital my_cloud_pr4100_firmware Improper Authentication
Vulnerability summary
CVE-2017-17560 is a high (CVSS 10.0) Improper Authentication vulnerability in westerndigital my_cloud_pr4100_firmware. EPSS estimates a 73.40% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 12-12-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
73.40%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 73.40% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (download.exploitee.rs)
Maturity: unknown
Western Digital MyCloud - 'multi_uploadify' File Upload (Metasploit)
Maturity: weaponized
Western Digital MyCloud multi_uploadify File Upload Vulnerability
exploit/linux/http/wd_mycloud_multiupload_upload
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Westerndigital1 product
- my_cloud_pr4100_firmware2.30.172
1 vendor · 1 product
References
3 links- download.exploitee.rs/file/generic/Exploiteers-DEFCON25.pdfX Refsource MISCExploitThird Party Advisory