CVE-2021-36224: Westerndigital My Cloud OS

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Western Digital My Cloud devices before OS5 have a nobody account with a blank password.

Affected products

• Westerndigital My Cloud OS: before 5.02.104 (fixed in 5.02.104)

Published 2023-02-06. Last modified 2026-06-17.