CVE-2020-15816

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-17 · updated 2026-06-17
Weakness: CWE-668

Description

In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables.

Affected products

Western Digital WD Discovery: before 4.0.251.0 — fixed in 4.0.251.0

How to fix

Upgrade to a fixed version: Western Digital WD Discovery 4.0.251.0. Check the vendor advisory for mitigations.

References

https://www.westerndigital.com/support/productsecurity/wdc-20005-wd-discovery-remote-command-execution-vulnerability
https://www.westerndigital.com/support/productsecurity/wdc-20005-wd-discovery-remote-command-execution-vulnerability

Get alerted when CVE-2020-15816 or the next vulnerability affects your stack