CVE-2017-17560: Westerndigital My Cloud PR4100 Firmware

Critical severity, CVSS 9.8. EPSS: 73.4% chance of exploitation in the next 30 days.

An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.

Affected products

Published 2017-12-12. Last modified 2026-06-17.