WD My Cloud NAS vulnerability detailed

News
By published

Make sure to update to the latest firmware ASAP.

With the recent news of the Meltdown and Spectre CPU exploits, security vulnerabilities are starting to get more attention. Quite a few places reported on the news that many of WD's My Cloud NAS units have a backdoor that gives full root access to the devices. Logging into the device with username "mydlinkBRionyg" and password "abc12345cba" is all it takes.

That's bad news, but after reaching out for comment from WD, we were informed that the affected devices have all been fixed since the release of firmware update v2.30.172—or in some cases firmware v2.30.168. We checked all the affected models and found that the updated firmware has been available since November 2017. Here's the full list of affected devices, with the vulnerability present on firmware releases v.2.30.165 and earlier:

  • My Cloud
  • My Cloud Mirror
  • My Cloud Gen 2
  • My Cloud PR2100
  • My Cloud PR4100
  • My Cloud EX2 Ultra
  • My Cloud EX2
  • My Cloud EX4
  • My Cloud EX2100
  • My Cloud EX4100
  • My Cloud DL2100
  • My Cloud DL4100

If you're running one of those NAS units, head over to WDC's My Cloud support page, select your specific model, and grab the latest firmware. And unlike the CPU exploits, there should be no loss of performance with the update, as all it does is remove a backdoor that should never have been there in the first place.

Jarred Walton
Jarred Walton

Jarred's love of computers dates back to the dark ages when his dad brought home a DOS 2.3 PC and he left his C-64 behind. He eventually built his first custom PC in 1990 with a 286 12MHz, only to discover it was already woefully outdated when Wing Commander was released a few months later. He holds a BS in Computer Science from Brigham Young University and has been working as a tech journalist since 2004, writing for AnandTech, Maximum PC, and PC Gamer. From the first S3 Virge '3D decelerators' to today's GPUs, Jarred keeps up with all the latest graphics trends and is the one to ask about game performance. 

Latest in Storage
Crucial X9 external SSD on blue background
You can pick up the 2 TB version of my favorite budget external SSD for less than $0.06 per GB, transfers 300+ GB of data in 6 minutes
A Samsung 9100 Pro SSD in both 2 TB and 4 TB sizes.
Samsung 9100 Pro 2 TB SSD review
An image of a WD_Black SN850X SSD against a teal background with a white border
The best 1 TB gaming SSD you can buy is now just $79, the cheapest it's been for a good while
WD Black SN850X SSD on a gaming PC case.
Looks like we won't be seeing Western Digital SSDs in our gaming PCs as the company hands the reins back over to SanDisk
A SanDisk Desk Drive external SSD on a blue background
I adore this chunky, reliable external SSD, so for a third off the 4 TB version I will absolutely recommend it in a heartbeat
The Buffalo RUF3-KEV USB drive on a red-orange gradient
This USB flash drive has a built-in anti-malware system, but I still wouldn't use one I found in a parking lot
Latest in News
An Enshrouded player in a recreation of Erebor from The Lord of the Rings
Kings under the Mountain! 33 Enshrouded players spent 10,000 hours to recreate this iconic location from The Lord of the Rings
A mech awakens.
Mecha Break developer is considering unlocking all mechs following open beta feedback
Lara Croft Unified Art
Tomb Raider developer Crystal Dynamics lays off 17 employees 'to better align our current business needs and the studio's future success'
A long bendy arm stealing money from people in a subway car
'You're a very long arm. You steal things. It's a comedy game,' explains developer of comedy game where you steal things with a very long arm
The heroes are attacked by monsters
Pillars of Eternity is getting turn-based combat to mark its 10th anniversary, and that means PC Gamer editors will soon be arguing about combat mechanics again
Image of Ronaldo from Fatal Fury: City of the Wolves trailer
It doesn't really make sense that soccer star Ronaldo is now a Fatal Fury character, but if you follow the money you can see how it happened
More about storage
Crucial X9 external SSD on blue background

You can pick up the 2 TB version of my favorite budget external SSD for less than $0.06 per GB, transfers 300+ GB of data in 6 minutes
A Samsung 9100 Pro SSD in both 2 TB and 4 TB sizes.

Samsung 9100 Pro 2 TB SSD review
kingdom come deliverance 2 thunderstone quest

Kingdom Come: Deliverance 2's masterful quest design can be summed up by one wonderfully weird search for a magic stone
See more latest
Most Popular
An Enshrouded player in a recreation of Erebor from The Lord of the Rings
Kings under the Mountain! 33 Enshrouded players spent 10,000 hours to recreate this iconic location from The Lord of the Rings
A mech awakens.
Mecha Break developer is considering unlocking all mechs following open beta feedback
Lara Croft Unified Art
Tomb Raider developer Crystal Dynamics lays off 17 employees 'to better align our current business needs and the studio's future success'
A long bendy arm stealing money from people in a subway car
'You're a very long arm. You steal things. It's a comedy game,' explains developer of comedy game where you steal things with a very long arm
The heroes are attacked by monsters
Pillars of Eternity is getting turn-based combat to mark its 10th anniversary, and that means PC Gamer editors will soon be arguing about combat mechanics again
Image of Ronaldo from Fatal Fury: City of the Wolves trailer
It doesn't really make sense that soccer star Ronaldo is now a Fatal Fury character, but if you follow the money you can see how it happened
Junah beginning a battle in Metaphor: ReFantazio.
Today's RPG fans are 'very sensitive to feeling like they wasted time' when they die, says Metaphor: ReFantazio battle planner—but Atlus still made combat hard anyway
Image of Cersei Lanniser from Game of Thrones: Kingsroad Steam early access trailer
A new Game of Thrones RPG is coming to Steam today with a cast of 'familiar faces,' which is good because it's really the only way to tell it's a GoT game at all
The new Prime Asset featured in the upcoming update for the Outlast Trials.
The Outlast Trials puts its already paranoid players under surveillance for a time-limited story event
A Viera looking confused in Final Fantasy 14.
Old armor continues to fall victim to Final Fantasy 14's bizarre two-channel dye system, unless you're super into changing the colour of teeny-tiny eyelets: 'Why even bother at this point?'