CVE-2021-36225: Westerndigital My Cloud OS

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation.

Affected products

• Westerndigital My Cloud OS: before 5.02.104 (fixed in 5.02.104)

Published 2023-02-06. Last modified 2026-06-17.