What’s Vulnerable › Vulnerabilities

CVE-2019-9951

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-24 · updated 2026-06-17
• Weakness: CWE-434

Description

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.

Affected products

• Western Digital My Cloud Dl2100: before 2.31.174 — fixed in 2.31.174
• Western Digital My Cloud Dl4100 Firmware: before 2.31.174 — fixed in 2.31.174
• Western Digital My Cloud Ex2100 Firmware: before 2.31.174 — fixed in 2.31.174
• Western Digital My Cloud Ex2 Ultra Firmware: before 2.31.174 — fixed in 2.31.174
• Western Digital My Cloud Ex4100: before 2.31.174 — fixed in 2.31.174
• Western Digital My Cloud Firmware: before 2.31.174 — fixed in 2.31.174
• Western Digital My Cloud Mirror Gen 2 Firmware: before 2.31.174 — fixed in 2.31.174
• Western Digital My Cloud Pr2100 Firmware: before 2.31.174 — fixed in 2.31.174
• Western Digital My Cloud Pr4100: before 2.31.174 — fixed in 2.31.174

How to fix

Upgrade to a fixed version: Western Digital My Cloud Dl2100 2.31.174; Western Digital My Cloud Dl4100 Firmware 2.31.174; Western Digital My Cloud Ex2100 Firmware 2.31.174; Western Digital My Cloud Ex2 Ultra Firmware 2.31.174; Western Digital My Cloud Ex4100 2.31.174; Western Digital My Cloud Firmware 2.31.174; Western Digital My Cloud Mirror Gen 2 Firmware 2.31.174; Western Digital My Cloud Pr2100 Firmware 2.31.174; Western Digital My Cloud Pr4100 2.31.174. Check the vendor advisory for mitigations.

References

• https://bnbdr.github.io/posts/wd/
• https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932
• https://github.com/bnbdr/wd-rce/
• https://support.wdc.com/downloads.aspx?g=2702&lang=en
• https://bnbdr.github.io/posts/wd/
• https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932
• https://github.com/bnbdr/wd-rce/
• https://support.wdc.com/downloads.aspx?g=2702&lang=en

Get alerted when CVE-2019-9951 or the next vulnerability affects your stack