CVE-2021-36224
📋 TL;DR
This vulnerability allows unauthenticated attackers to gain root access to Western Digital My Cloud network-attached storage devices by exploiting a default 'nobody' account with a blank password. It affects all My Cloud devices running firmware versions before OS5. This enables complete device compromise and data theft.
💻 Affected Systems
- Western Digital My Cloud NAS devices
📦 What is this software?
My Cloud Os by Westerndigital
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover, data exfiltration, ransomware deployment, and use as pivot point for network attacks.
Likely Case
Unauthorized access to stored files, device configuration changes, and potential data theft.
If Mitigated
Limited impact if device is isolated from internet and strong network controls are in place.
🎯 Exploit Status
Simple authentication bypass requiring only network access to the device. Exploit code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OS5 and later
Vendor Advisory: https://www.westerndigital.com/support/product-security/wdc-21006-my-cloud-os5-firmware-release
Restart Required: Yes
Instructions:
1. Log into My Cloud web interface. 2. Navigate to Settings > Firmware. 3. Check for updates. 4. Install OS5 or later firmware. 5. Device will reboot automatically.
🔧 Temporary Workarounds
Network Isolation
allRemove device from internet exposure by placing behind firewall or in isolated network segment.
Disable Remote Access
allTurn off all remote access features in My Cloud settings.
🧯 If You Can't Patch
- Immediately disconnect device from internet and place in isolated VLAN
- Implement strict firewall rules to block all inbound access to device ports
🔍 How to Verify
Check if Vulnerable:
Check firmware version in My Cloud web interface under Settings > Firmware. If version is below OS5, device is vulnerable.Check Version:
ssh nobody@[device_ip] (if vulnerable, will grant access without password)Verify Fix Applied:
Confirm firmware version shows OS5 or higher in Settings > Firmware. Attempt SSH login with 'nobody' account and blank password should fail.📡 Detection & Monitoring
Log Indicators:
- Failed SSH login attempts
- Successful authentication as 'nobody' user
- Unusual file access patterns
Network Indicators:
- SSH connections to device from unexpected sources
- Port scanning activity targeting device
SIEM Query:
source="mycloud" AND (event="authentication" AND user="nobody") OR (event="ssh_login" AND result="success")🔗 References
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
- https://www.youtube.com/watch?v=vsg9YgvGBec
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
- https://www.youtube.com/watch?v=vsg9YgvGBec
