CVE-2019-18930

Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest account) to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so, and download_mgr.cgi makes it possible to enter large-sized f_idx inputs.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/DelspoN/CVE/blob/master/CVE-2019-18930/description.txt	Third Party Advisory
https://github.com/DelspoN/CVE/tree/master/CVE-2019-18930	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:western_digital:my_cloud_ex2_ultra_firmware:2.31.183:*:*:*:*:*:*:*

cpe:2.3:h:western_digital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-11-13 16:15

Updated : 2019-11-15 20:08

NVD link : CVE-2019-18930

Mitre link : CVE-2019-18930

CVE.ORG link : CVE-2019-18930

JSON object : View

Products Affected

western_digital

my_cloud_ex2_ultra
my_cloud_ex2_ultra_firmware

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-18930", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-11-13T16:15:11.207", "references": [{"url": "https://github.com/DelspoN/CVE/blob/master/CVE-2019-18930/description.txt", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/DelspoN/CVE/tree/master/CVE-2019-18930", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest account) to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so, and download_mgr.cgi makes it possible to enter large-sized f_idx inputs."}, {"lang": "es", "value": "El firmware Western Digital My Cloud EX2 Ultra versi\u00f3n 2.31.183, permite a usuarios web (incluida la cuenta de invitado) ejecutar remotamente c\u00f3digo arbitrario por medio de un desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria. No existe una l\u00f3gica de comprobaci\u00f3n de tama\u00f1o en una de las funciones en el archivo libscheddl.so, y download_mgr.cgi hace posible ingresar entradas f_idx de gran tama\u00f1o."}], "lastModified": "2019-11-15T20:08:32.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:western_digital:my_cloud_ex2_ultra_firmware:2.31.183:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A2F5116-0257-4C89-964F-2B3A32FCC9C3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:western_digital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F7BD0108-A509-4F54-86D5-5471D079D280"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}