A vulnerability has been found in Western Digital My Cloud EX2 Ultra 2.31.195 (Cloud Software) and classified as critical. Affected by this vulnerability is an unknown code block of the component Instruction Pointer. The manipulation as part of a POST Parameter leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via crafted GET/POST parameters.

The weakness was disclosed 11/13/2019. This vulnerability is known as CVE-2019-18931 since 11/12/2019. The attack can be launched remotely. The requirement for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-145506 and VDB-145505 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Western Digital

Name

• My Cloud EX2 Ultra

Version

• 2.31.195

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion