CVE-2017-17560
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 73%
from disclosure to weapon6 days
Published on NVDDec 12
1st PoC+6d
metasploitJul 29
VulnCheck+2232d
exploitation probability
73%top 1% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.
Affected products
n/a · n/apublic PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/43356cve_referencewww.exploit-db.com/exploits/43356/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.