Western Digital has released a hot fix firmware to resolve the authentication bypass issue (CVE-2018-17153) that has existed in My Cloud NAS devices for over a year.
The vulnerability could allow anyone to gain root access to the devices. When a hacker logged into a Western Digital router with root privileges, they could change critical settings such as installing modified firmware, changing DNS addresses leading to phishing attacks, or making other malicious changes.
After the issue became widespread, Western Digital said it would soon release a hot fix to cover the vulnerability and secure its customers' systems, which it did. On September 21, Western Digital announced the release of the security update via a Tweet.
For those using Western Digital My Cloud NAS devices, you can download the appropriate firmware updates from the following list:
- My Cloud FW 2.30.196
- My Cloud Mirror Gen2 FW 2.30.196
- My Cloud EX2 Ultra FW 2.30.196
- My Cloud EX2100 FW 2.30.196
- My Cloud EX4100 FW 2.30.196
- My Cloud DL2100 FW 2.30.196
- My Cloud DL4100 FW 2.30.196
- My Cloud PR2100 FW 2.30.196
- My Cloud PR4100 FW 2.30.196
If you need help updating your device, you can find detailed installation instructions in the guide published by WD for this update. It is important to apply the update soon, as without it your devices are exposed. Before updating, as the detailed guide states, it is recommended to take a backup.
