Is CVE-2019-9951 actively exploited?

CVE-2019-9951 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2019-9951?

CVE-2019-9951 has a CVSS score of 9.8 (CRITICAL severity). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How do I patch CVE-2019-9951?

Patch guidance is available from western digital security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2019-9951.

Fix CVE-2019-9951 - CRITICAL

Q: Which products are affected by CVE-2019-9951?

9 products: western digital my cloud mirror gen 2 firmware, western digital my cloud ex2 ultra firmware, western digital my cloud ex2100 firmware, western digital my cloud ex4100, western digital my cloud dl2100, and 4 more.

Description

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.

CVSS Metrics

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-434 · Unrestricted File Upload

Metadata

Primary Vendor: WESTERN_DIGITAL
Published: 4/24/2019
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

western_digital : my_cloud_mirror_gen_2_firmwarewestern_digital : my_cloud_ex2_ultra_firmwarewestern_digital : my_cloud_ex2100_firmwarewestern_digital : my_cloud_ex4100western_digital : my_cloud_dl2100western_digital : my_cloud_dl4100_firmwarewestern_digital : my_cloud_pr2100_firmwarewestern_digital : my_cloud_pr4100western_digital : my_cloud_firmware

Remediation Guidance

Executive Summary

View on NIST NVD