The refactor centralized the authentication logic into a single file, which is present on the device as includes/component_config.php and contains the authentication type required by each end point. We have determined that the unauthenticated factory reset vulnerability was introduced to the My Book Live in April of 2011 as depart of a refactor of authentication logic in the device firmware.

We have heard concerns about the nature of this vulnerability and are sharing technical details to address these questions. The unauthenticated factory reset vulnerability been assigned CVE-2021-35941. additionally, the My Book Live is vulnerable to an unauthenticated factory reset operation which allows an attacker to factory reset the device without authentication. This vulnerability may be exploited to run arbitrary commands with root privileges. The My Book Live firmware is vulnerable to a remotely exploitable command injection vulnerability when the device has outside entree enabled. You can find more details on these programs by following the links below :Īnalysis of Newly Identified Vulnerability CVE-2021-35941 My Book Live customers are besides offered a trade-in course of study to upgrade to a supported My Cloud device. Western Digital is offering a datum recovery service broadcast to help customers who have lost data as a consequence of these attacks. ĭata Recovery and Product Trade-In Programs In some cases, the attackers have triggered a factory readjust that appears to erase all data on the device. Western Digital has determined that Internet-connected My Book Live and My Book Live Duo devices are under fire by exploitation of multiple vulnerabilities present in the device.

Western digital my book live security