noindex and left out of the sitemap until more data is confirmed.CVE-2025-30247 is an OS command injection vulnerability (CWE-78) in the web management user interface of Western Digital's My Cloud network-attached storage firmware: a remote attacker can send a specially crafted HTTP POST request to the device and execute arbitrary system commands without needing any prior authentication, and Western Digital's own PSIRT scored the flaw 9.3 (critical) on the CVSS v4.0 scale; NVD has not yet published its own Primary CVSS score.
Vulnerability summary
N/A
Not yet scored
1.1%
EPSS score (FIRST)
No
CISA KEV catalog
2025-09-29
Published
Vulnerability ID: CVE-2025-30247 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Western Digital My Cloud NAS firmware (web management user interface) | — | My Cloud OS 5 firmware prior to 5.31.108, affecting the My Cloud PR2100, PR4100, EX4100, EX2 Ultra, Mirror Gen 2, DL2100, EX2100, DL4100 and WDBCTLxxxxxx-10 models; fixed in firmware 5.31.108, per Western Digital advisory WDC-25006 |
What does this mean for affected devices?
CVE-2025-30247 (CWE-78, OS command injection) affects the web user interface of Western Digital's My Cloud NAS firmware. NVD's description states: "An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST" (NVD).
Western Digital's own advisory, WDC-25006, "Western Digital My Cloud OS 5 Firmware 5.31.108," lists the affected models as My Cloud PR2100, PR4100, EX4100, EX2 Ultra, Mirror Gen 2, DL2100, EX2100, DL4100 and WDBCTLxxxxxx-10, and credits security researcher "w1th0ut" with identifying and reporting the issue. The advisory describes the fix simply as having "resolved a security issue related to remote code execution," and recommends that users "promptly update their devices to the latest firmware" (Western Digital WDC-25006).
NVD tracks CVE-2025-30247 with status "Deferred" as of this review: it records only a Western Digital PSIRT-submitted score (source [email protected]) — CVSS v4.0 9.3 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD). The PR:N and UI:N components of that vector mean the vendor's own analysis treats this as exploitable with no authentication and no user interaction at all, consistent with NVD's plain-text description.
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01089 (65.5th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
NVD has not finished its own severity analysis. In the meantime, operators of the affected My Cloud models should update to firmware 5.31.108 or later, and avoid exposing the device's web management interface directly to the internet.
Evidence
- An OS command injection vulnerability in the user interface of Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST. — NVD
- Affects My Cloud PR2100, PR4100, EX4100, EX2 Ultra, Mirror Gen 2, DL2100, EX2100, DL4100 and WDBCTLxxxxxx-10; reported by researcher 'w1th0ut'; fixed in firmware 5.31.108, described as resolving 'a security issue related to remote code execution.' — Western Digital Security Advisory WDC-25006
- NVD status 'Deferred'; records only Western Digital's own Secondary CVSS v4.0 score of 9.3, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; no NVD-published Primary score as of this review. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01089 (65.5th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
