Critical severity9.8NVD Advisory· Published Jan 3, 2017· Updated May 6, 2026

CVE-2016-10108

Description

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.

Affected products

Western Digital/Mycloud Nas
cpe:2.3:a:western_digital:mycloud_nas:2.11.142:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.stevencampbell.info/2016/12/command-injection-in-western-digital-mycloud-nas/nvdExploitThird Party Advisory
packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.htmlnvd
www.securityfocus.com/bid/95200nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.074
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000