CVE-2021-3310: Westerndigital My Cloud OS

High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days.

Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).

Affected products

• Westerndigital My Cloud OS: before 5.10.122 (fixed in 5.10.122)

Published 2021-03-10. Last modified 2026-06-17.