CVE-2020-27159 — OS Command Injection in MY Cloud Firmware

CWE-78 — OS Command InjectionCWE-20 — Improper Input Validation2 documents2 sources
Severity
9.8CRITICALNVD
EPSS
8.3%
top 7.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Westerndigital MY Cloud Firmware
Timeline
PublishedOct 27
Latest updateMay 24

Description

Addressed remote code execution vulnerability in DsdkProxy.php due to insufficient sanitization and insufficient validation of user input in Western Digital My Cloud NAS devices prior to 5.04.114

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-8vhp-mfqv-2pqj: Addressed remote code execution vulnerability in DsdkProxy↗2022-05-24
▶