CVE-2018-17153: Western Digital My Cloud authentication bypass via cgi_get_ipv6 admin session creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, full device compromise, and very high EPSS probability make this an urgent patching priority.

What it is

Western Digital My Cloud devices before firmware 2.30.196 contain an authentication bypass in the network_mgr.cgi module. Calling the cgi_get_ipv6 command with the parameter flag=1 creates a server-side admin session bound to the requester's IP address without any login, and setting the username=admin cookie then allows authenticated CGI commands to succeed. This gives an unauthenticated network attacker full administrative control of the device.

Impact

An attacker gains full admin control of the My Cloud device, including access to stored data and administrative functions. Because the session is bound to the attacker's IP, the bypass is directly usable from the network without credentials.

Attack surface

Reachable over the network via HTTP requests to the device's CGI interface, specifically network_mgr.cgi with the cgi_get_ipv6 command and flag=1. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.866, 99.7th percentile) and a public advisory is tagged Exploit, indicating known public exploitation techniques.

What to do

• Update My Cloud firmware to 2.30.196 or later as directed by Western Digital advisory 25952.
• If patching is not immediately possible, restrict network access to the device's web/CGI interface to trusted management networks only.
• Disable or block remote access features and UPnP port forwarding that expose the device's admin interface to untrusted networks.
• Monitor Western Digital support advisories for further firmware updates covering the listed My Cloud models.

Detection

• Search HTTP access logs for requests to network_mgr.cgi with cgi_get_ipv6 and flag=1 parameters.
• Alert on requests containing a username=admin cookie from source IPs that have not performed a legitimate login.
• Correlate admin session creation events with the absence of preceding authentication requests from the same source IP.
• Monitor for unusual administrative CGI command sequences originating from a single external IP shortly after a cgi_get_ipv6 call.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.