Vulnerability record · CVE-2016-10108 · published 3 January 2017
CVE-2016-10108: Western Digital MyCloud NAS unauthenticated command injection in google_analytics.php
Western Digital · Mycloud Nas
The /web/google_analytics.php endpoint on Western Digital MyCloud NAS 2.11.142 passes a POST 'arg' parameter into a shell command without sanitization, allowing command injection. Because the endpoint is reachable without authentication and the injected commands run as root, any network-reachable attacker can take full control of the device.
Description
Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote root command execution with a near-maximum EPSS score and a public exploit makes this an urgent exposure for any internet- or LAN-reachable MyCloud device.
What it is
The /web/google_analytics.php endpoint on Western Digital MyCloud NAS 2.11.142 passes a POST 'arg' parameter into a shell command without sanitization, allowing command injection. Because the endpoint is reachable without authentication and the injected commands run as root, any network-reachable attacker can take full control of the device.
Impact
An attacker gains arbitrary command execution as root on the NAS, enabling full device compromise, data theft, persistent backdooring, and use of the device as a foothold into the local network.
Attack surface
Reachable over the network via HTTP POST to /web/google_analytics.php with a modified 'arg' parameter; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
No CISA KEV listing, but EPSS is 0.9782 (99.9th percentile) and a public exploit write-up is referenced, indicating high likelihood of active exploitation.
What to do
- Apply the vendor firmware update that fixes the command injection in google_analytics.php; if no patch is available, isolate or retire the device.
- Block or restrict network access to the MyCloud web interface (especially /web/google_analytics.php) from untrusted networks.
- Place the NAS behind a firewall and do not expose its management interface to the internet.
- Monitor vendor advisories for Western Digital MyCloud and replace end-of-support units.
- If the device cannot be patched, disable remote access features and segment it on a restricted VLAN.
Detection
- Inspect HTTP logs for POST requests to /web/google_analytics.php with suspicious or shell-metacharacter content in the 'arg' parameter.
- Monitor for unexpected outbound connections or processes spawned by the web server on the NAS.
- Alert on command-shell activity originating from the web service user or root processes tied to the web interface.
- Review NAS audit logs for anomalous file changes or new accounts following web requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-10108 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-10108), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
