CVE-2019-9950: Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR210...

Description

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials against /etc/shadow. However, the "nobody" account (which can be used to access the control panel API as a low-privilege logged-in user) has a default empty password, allowing an attacker to modify the My Cloud EX2 Ultra web page source code and obtain access to the My Cloud as a non-Admin My Cloud device user.

Metrics

EPSS Probability

2.30%

81.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-521

Affected Software

Vendor	Product	Versions
Westerndigital	My Cloud Firmware	< 2.31.174
Westerndigital	My Cloud Mirror Gen2 Firmware	< 2.31.174
Westerndigital	My Cloud Ex2 Ultra Firmware	< 2.31.174
Westerndigital	My Cloud Ex2100 Firmware	< 2.31.174
Westerndigital	My Cloud Ex4100 Firmware	< 2.31.174
Westerndigital	My Cloud Dl2100 Firmware	< 2.31.174
Westerndigital	My Cloud Dl4100 Firmware	< 2.31.174
Westerndigital	My Cloud Pr2100 Firmware	< 2.31.174
Westerndigital	My Cloud Pr4100 Firmware	< 2.31.174

References

Timeline

Published: Apr 24, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-9950?

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials against /etc/shadow. However, the "nobody" account (which can be used to access the control panel API as a low-privilege logged-in user) has a default empty password, allowing an attacker to modify the My Cloud EX2 Ultra web page source code and obtain access to the My Cloud as a non-Admin My Cloud device user.

How severe is CVE-2019-9950?

Severity scoring for CVE-2019-9950 is pending analysis. The EPSS model estimates a 2.30% probability of exploitation in the next 30 days.

How do I fix CVE-2019-9950?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.