CVE-2021-3310
📋 TL;DR
Western Digital My Cloud OS 5 devices before version 5.10.122 have a symbolic link following vulnerability in SMB and AFP shares. This allows attackers to read local files (information disclosure) and potentially execute code. All users of affected My Cloud devices are at risk.
💻 Affected Systems
- Western Digital My Cloud OS 5 devices
📦 What is this software?
My Cloud Os by Westerndigital
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data theft, and lateral movement to other network systems.
Likely Case
Unauthorized reading of sensitive files stored on the My Cloud device, potentially including credentials, configuration files, and user data.
If Mitigated
Limited impact if shares are restricted to trusted users and network segmentation is implemented.
🎯 Exploit Status
The vulnerability allows unauthenticated attackers to exploit via SMB/AFP protocols. No public exploit code has been released, but the vulnerability is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.10.122
Vendor Advisory: https://www.westerndigital.com/support/productsecurity/wdc-21002-my-cloud-firmware-version-5-10-122
Restart Required: Yes
Instructions:
1. Log into My Cloud web interface. 2. Navigate to Settings > Firmware. 3. Check for updates and install version 5.10.122 or later. 4. Reboot the device after installation.
🔧 Temporary Workarounds
Disable SMB and AFP shares
allTemporarily disable SMB and AFP file sharing protocols to prevent exploitation.
Restrict share access
allConfigure shares to allow access only from specific trusted IP addresses or users.
🧯 If You Can't Patch
- Isolate the My Cloud device on a separate VLAN with strict firewall rules limiting SMB/AFP traffic to trusted hosts only.
- Implement network monitoring for unusual SMB/AFP activity and file access patterns to detect potential exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check the firmware version in My Cloud web interface under Settings > Firmware. If version is below 5.10.122, the device is vulnerable.Check Version:
Not applicable - check via web interface or device displayVerify Fix Applied:
Confirm firmware version shows 5.10.122 or higher after update and reboot.📡 Detection & Monitoring
Log Indicators:
- Unusual SMB/AFP connection attempts from unexpected IP addresses
- Multiple failed authentication attempts followed by successful file access
- Access to system files or directories not typically accessed via shares
Network Indicators:
- SMB or AFP traffic to My Cloud device from untrusted networks
- Unusual file transfer patterns via SMB/AFP protocols
SIEM Query:
source="mycloud" AND (protocol="SMB" OR protocol="AFP") AND (event="file_access" OR event="connection") AND src_ip NOT IN [trusted_ips]🔗 References
- https://www.westerndigital.com/support/productsecurity/wdc-21002-my-cloud-firmware-version-5-10-122
- https://www.zerodayinitiative.com/advisories/ZDI-21-277/
- https://www.westerndigital.com/support/productsecurity/wdc-21002-my-cloud-firmware-version-5-10-122
- https://www.zerodayinitiative.com/advisories/ZDI-21-277/
