Another 0-Day Looms for Many Western Digital Users
Summary: Researchers Radek Domanski and Pedro Ribeiro found a remote code execution flaw in all Western Digital NAS devices running MyCloud OS 3, an operating system Western Digital stopped supporting in 2021, and published a video in February 2021 showing how a low-privileged account with a blank password can push malicious firmware to a vulnerable device. Western Digital said the bug was already fixed by MyCloud OS 5, did not answer whether it was ever patched in OS 3, and stated it will not evaluate or support the third-party patch the researchers released.
What's compelling: Western Digital's own support page still drew enough OS 3 posts for the researcher to call the user base considerable, and OS 5 broke functionality that keeps some owners from migrating - so an unpatched remote code execution flaw sits on internet-reachable storage that may hold the only copy of a customer's data.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026