CVE-2017-17560

An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.

• CWE-287

• https://download.exploitee.rs/file/generic/Exploiteers-DEFCON25.pdfExploit, Third Party Advisory
• https://github.com/rapid7/metasploit-framework/pull/9248Third Party Advisory
• https://www.exploit-db.com/exploits/43356/Exploit, Third Party Advisory, VDB Entry
• https://download.exploitee.rs/file/generic/Exploiteers-DEFCON25.pdfExploit, Third Party Advisory
• https://github.com/rapid7/metasploit-framework/pull/9248Third Party Advisory
• https://www.exploit-db.com/exploits/43356/Exploit, Third Party Advisory, VDB Entry

Published

Dec 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17554A NULL pointer dereference (DoS) Vulnerability was found in …
• CVE-2017-17555The swri_audio_convert function in audioconvert.c in FFmpeg …
• CVE-2017-17556A debug tool in Synaptics TouchPad drivers allows local user…
• CVE-2017-17557In Foxit Reader before 9.1 and Foxit PhantomPDF before 9.1, …
• CVE-2017-17558The usb_destroy_configuration function in drivers/usb/core/c…
• CVE-2017-1756IBM Business Process Manager 8.6 allows web pages to be stor…4
• CVE-2017-17561SeaCMS 6.56 allows remote authenticated administrators to ex…
• CVE-2017-17562Embedthis GoAhead before 3.6.5 allows remote code execution …8.1
• CVE-2017-17563An issue was discovered in Xen through 4.9.x allowing guest …
• CVE-2017-17564An issue was discovered in Xen through 4.9.x allowing guest …
• CVE-2017-17565An issue was discovered in Xen through 4.9.x allowing PV gue…
• CVE-2017-17566An issue was discovered in Xen through 4.9.x allowing PV gue…