CVE-2019-16399

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-09-18 · updated 2026-06-17
Weakness: CWE-798

Description

Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me.

Affected products

Westerndigital Wd My Book Firmware: through 1.02.12

References

http://packetstormsecurity.com/files/154524/Western-Digital-My-Book-World-II-NAS-1.02.12-Hardcoded-Credential.html
https://gist.github.com/pak0s/22ad6bae26198ebcd137b61adb6fcfe6
http://packetstormsecurity.com/files/154524/Western-Digital-My-Book-World-II-NAS-1.02.12-Hardcoded-Credential.html
https://gist.github.com/pak0s/22ad6bae26198ebcd137b61adb6fcfe6

Get alerted when CVE-2019-16399 or the next vulnerability affects your stack