Major Security Flaws Discovered in Western Digital’s My Cloud NAS Drives

Western Digital (WD) Corporation network-attached storage owners were warned of critical flaws in the company’s My Cloud line of hardware that exposed data stored on the devices to attack. The flaws impact a dozen Western Digital drives that could allow remote adversaries to bypass logins, insert commands, upload files without permission, and gain control of devices.

The affected firmware versions (and models) are: At least version 2.21.126 (My Cloud), 2.11.157 (My Cloud EX2), 2.21.126 (My Cloud EX2 Ultra), 2.11.157 (My Cloud EX4), 2.21.126 (My Cloud EX2100), 2.21.126 (My Cloud EX4100), 2.11.157 (My Cloud Mirror), 2.21.126 (My Cloud Mirror Gen2), 2.21.126 (My Cloud PR2100), 2.21.126 (My Cloud PR4100), 2.21.126 (My Cloud DL2100), and 2.21.126 (My Cloud DL4100).

What Should You Do?

• • Do not to attach WD My Cloud to the network until a thorough security review has been performed by security professionals and all identified issues have been resolved.
  • Visit the products page of the Western Digital website to see if your version was affected or contact the WD customer support team.

Note that to date the issue has not been acknowledged on the company website.