CVE-2019-16399: Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without…

PriorityP272critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

7.08%

93.4th percentile

Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
westerndigital	wd_my_book_firmware	<= 1.02.12	—

Detection & IOCsextracted from sources · hover to see the quote

url/admin/system_advanced.php?lang=en↗

path/admin/↗

commandPOST /admin/system_advanced.php?lang=en HTTP/1.1↗

commandorig_ssl_key=&orig_ssl_certificate=&submit_type=ssh&current_ssh=&enablessh=yes&Submit=Submit&ssl_certificate=Paste+a+signed+certificate+in+X.509+PEM+format+here.&ssl_key=Paste+a+RSA+private+key+in+PEM+format+here.&hddstandby=on&ledcontrol=on↗

otherwelc0me↗

→Detect unauthenticated POST requests to /admin/system_advanced.php containing 'enablessh=yes' in the body, which indicates an attempt to enable SSH without credentials. ↗
→Alert on any unauthenticated HTTP access to the /admin/ directory on WD My Book World devices, as no credentials are required due to broken authentication. ↗
→Monitor for SSH login attempts using the username 'root' and password 'welc0me' on WD My Book World NAS devices, especially following HTTP POST activity to /admin/system_advanced.php. ↗
→Use the Google Dork 'intitle:"My Book World Edition - MyBookWorld"' to identify exposed WD My Book World devices on the internet. ↗

·The device runs PHP 4, which is end-of-life and may expose additional remote exploitation vectors beyond this CVE. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.