If you have one of Western Digital’s My Cloud nstorage drives, you might be particularly vulnerable to internet attacks. Exploitee.rs has discovered a number of unpatched security flaws in most My Cloud models that let remote intruders bypass the login, insert their own commands and upload files without permission. In numerous cases, it’s a matter of poorly implemented scripts. Also, every command exectued through the web interface has full access to the operating system — an attacker would have the keys to the kingdom.
The kicker? WD did fix one login bypass flaw through a firmware update, but it introduced another in the process.