Western Digital has released security updates for a critical vulnerability affecting multiple My Cloud network-attached storage (NAS) devices.
The flaw, tracked as CVE-2025-30247, could allow a remote attacker to execute arbitrary code on vulnerable systems, potentially leading to a complete device takeover.
The company addressed the high-severity issue in My Cloud Firmware version 5.31.108, which was released on September 24, 2025.
A successful exploit of this remote code execution (RCE) vulnerability would enable an unauthenticated attacker to compromise the security of the NAS device.
This could result in data theft, the deployment of malware or ransomware, or the integration of the compromised device into a botnet for use in further attacks.
Given that NAS devices often store sensitive personal and business data, the impact of such a compromise could be severe.
Western Digital has strongly urged all users to promptly update their devices to the latest firmware to mitigate the threat. The update can be applied directly through the firmware update notification within the device’s administrative interface.
The advisory credits security researcher w1th0ut for discovering and responsibly reporting the vulnerability, allowing the company to develop and issue a patch.
Affected Devices and Mitigation
The security update is crucial for a wide range of products in the My Cloud family. Western Digital has confirmed that the following devices are impacted and should be updated to firmware version 5.31.108 or later to be protected against CVE-2025-30247.
- My Cloud PR2100
- My Cloud PR4100
- My Cloud EX4100
- My Cloud EX2 Ultra
- My Cloud Mirror Gen 2
- My Cloud DL2100
- My Cloud EX2100
- My Cloud DL4100
- My Cloud WDBCTLxxxxxx-10
- My Cloud
This incident highlights the ongoing security risks associated with internet-connected storage devices. Threat actors frequently scan for and target unpatched NAS systems due to the valuable data they contain.
Applying security patches as soon as they become available is one of the most effective measures users can take to protect their data from unauthorized access and cyberattacks.
Users are advised to review their device settings and ensure that automatic updates are enabled, where possible, to maintain security.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
