CVE-2018-18472
Western Digital WD My Book Live (all versions) has a root Remote Command Execution bug via shell...
Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,
- Record
CVE-2018-18472- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,
- Record
CVE-2018-18472- Updated
- 2026-11-02
EUVDEUVD-2018-10200 No score
Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,
- Record
EUVD-2018-10200- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gjqh-4gc9-vchf No score
Western Digital WD My Book Live (all versions) has a root Remote Command Execution bug via shell...
Western Digital WD My Book Live (all versions) has a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device.
- Record
GHSA-gjqh-4gc9-vchf- Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-18472 is a critical vulnerability (CVSS 9.8) in Westerndigital My Book Live Firmware, published June 19, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.3%, the 98th percentile. No source names a fixed version.
References
wizcase.com/blog/hack-2018
westerndigital.com/support/productsecurity/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo
community.wd.com/t/action-required-on-my-book-live-and-my-book-live-duo/268147
nvd.nist.gov/vuln/detail/CVE-2018-18472
wdc.com
github.com/advisories/GHSA-gjqh-4gc9-vchf