CVE-2016-10108 is an unauthenticated remote command injection vulnerability affecting Western Digital MyCloud NAS devices running firmware version 2.11.142. An attacker can achieve root-level command execution by manipulating the 'arg' parameter in POST data sent to the /web/google_analytics.php URL. This critical vulnerability, with a CVSS score of 9.8, allows for complete compromise of confidentiality, integrity, and availability without requiring any user interaction or authentication. While not listed in CISA's KEV catalog, public exploit modules exist in Metasploit and Nuclei, and it has garnered significant community discussion and media coverage, indicating its exploitability and potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.11.142CPE matchmatch criteria | cpe:2.3:a:western_digital:mycloud_nas:2.11.142:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.