CVE-2020-27158

CRITICAL

9.8

CVSS Score

Published: October 27, 2020 at 07:46 PM UTC

Updated: June 17, 2026 at 03:08 AM UTC

7 products affected across 1 vendorMy Cloud FirmwareMy CloudMy Cloud PR4100

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploit prediction

EPSS 7%

Description

Addressed remote code execution vulnerability in cgi_api.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud Firmware · Westerndigital

95%

v < 5.04.114

Affected range stops below 5.04.114, so it looks safe — our inference, not a vendor statement

My Cloud · Westerndigital

90%

v < 5.04.114

Affected range stops below 5.04.114, so it looks safe — our inference, not a vendor statement

westerndigital-my-cloud-ex4100 (same device) · westerndigital-my-cloud-expert-series-ex2 (same device) · westerndigital-my-cloud-mirror-gen-2 (same device) · westerndigital-my-cloud-pr2100 (same device) · westerndigital-my-cloud-pr4100 (same device)

My Cloud EX4100 · Westerndigitaldevice

80%

All versions

My Cloud Expert Series Ex2 · Westerndigitaldevice

80%

All versions

My Cloud Mirror Gen 2 · Westerndigitaldevice

80%

All versions

My Cloud PR2100 · Westerndigitaldevice

80%

All versions