CVE-2019-16399
Description
Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Western Digital WD/My Book Worlddescription
- Range: <=1.02.12
Patches
Vulnerability mechanics
Root cause
"The system allows access to administrative functions without proper authentication, enabling unauthorized configuration changes."
Attack vector
An attacker can access the `/admin/` directory without providing any credentials, exploiting a broken authentication vulnerability [ref_id=1]. From there, they can navigate to `/admin/system_advanced.php?lang=en` and submit a POST request to enable SSH [ref_id=1, ref_id=2]. This action allows an attacker to then log in via SSH using the default root password 'welc0me' [ref_id=1, ref_id=2].
Affected code
The vulnerability lies within the administrative interface, specifically in the handling of requests to `/admin/system_advanced.php?lang=en` [ref_id=1, ref_id=2]. The system fails to properly authenticate users before allowing them to modify advanced system settings, such as enabling SSH access.
What the fix does
The advisory does not specify a patch or provide details on how the vulnerability is fixed. It recommends abandoning the affected NAS device and switching to newer hardware due to its outdated nature and the potential for further remote exploits [ref_id=1, ref_id=2].
Preconditions
- authThe attacker does not need any valid credentials to access the administrative interface.
- networkThe attacker must be able to reach the device over the network.
Reproduction
POST /admin/system_advanced.php?lang=en HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 Content-Length: 241
orig_ssl_key=&orig_ssl_certificate=&submit_type=ssh¤t_ssh=&enablessh=yes&Submit=Submit&ssl_certificate=Paste+a+signed+certificate+in+X.509+PEM+format+here.&ssl_key=Paste+a+RSA+private+key+in+PEM+format+here.&hddstandby=on&ledcontrol=on [ref_id=1, ref_id=2]
Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- packetstormsecurity.com/files/154524/Western-Digital-My-Book-World-II-NAS-1.02.12-Hardcoded-Credential.htmlmitrex_refsource_MISC
- gist.github.com/pak0s/22ad6bae26198ebcd137b61adb6fcfe6mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.