CVE-2021-36226
📋 TL;DR
Western Digital My Cloud devices running firmware before OS5 lack cryptographic signature verification for firmware updates, allowing attackers to upload and execute malicious firmware. This affects all users of My Cloud devices with firmware versions prior to OS5, potentially compromising the entire device and stored data.
💻 Affected Systems
- Western Digital My Cloud NAS devices
📦 What is this software?
My Cloud Os by Westerndigital
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover with persistent malware installation, data theft/encryption, and use as a foothold into the network.
Likely Case
Remote code execution leading to data compromise, ransomware deployment, or device bricking.
If Mitigated
Limited impact if device is isolated and firmware updates are controlled.
🎯 Exploit Status
Public proof-of-concept exists from Pwn2Own Tokyo 2020. Exploitation requires network access to device's web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OS5 firmware or later
Vendor Advisory: https://www.westerndigital.com/support/product-security/wdc-21006-my-cloud-firmware-update-version-5-04-114
Restart Required: Yes
Instructions:
1. Backup all data. 2. Log into My Cloud web interface. 3. Navigate to Settings > Firmware. 4. Check for and install OS5 update. 5. Device will reboot automatically.
🔧 Temporary Workarounds
Network Isolation
allBlock My Cloud device from internet access and restrict to internal network only.
Firewall Rules
linuxBlock access to My Cloud web interface ports (typically 80/443) from untrusted networks.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Disable remote access features and ensure device is only accessible from trusted internal networks.
- Implement strict network segmentation and monitor for unusual firmware update attempts.
🔍 How to Verify
Check if Vulnerable:
Check firmware version in My Cloud web interface under Settings > Firmware. If version starts with 4.x or lower, device is vulnerable.Check Version:
curl -k https://[device-ip]/api/2.1/rest/system_info | grep firmware_versionVerify Fix Applied:
Verify firmware version shows OS5.x or higher in Settings > Firmware.📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware update attempts
- Unauthorized file uploads to firmware endpoints
- System reboots without user action
Network Indicators:
- HTTP POST requests to /api/2.1/rest/firmware_update
- Unusual outbound connections from My Cloud device
SIEM Query:
source="mycloud.log" AND ("firmware_update" OR "upload" AND "firmware")🔗 References
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
- https://www.youtube.com/watch?v=vsg9YgvGBec
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
- https://www.youtube.com/watch?v=vsg9YgvGBec
