Cyber Security News reports that Western Digital has issued a critical security update to fix a flaw in multiple My Cloud network-attached storage devices that could allow attackers to take complete control of vulnerable systems.
The vulnerability, identified as CVE-2025-30247, is a remote code execution bug that could be exploited without authentication, putting sensitive data at risk of theft, ransomware attacks, or integration into botnets.
The company released firmware version 5.31.108 on September 24, 2025, to address the issue and urged customers to apply the update immediately through the device's administrative interface. Security researcher w1th0ut was credited with responsibly reporting the flaw, which affects a wide range of My Cloud products including PR2100, PR4100, EX4100, and EX2 Ultra.
Analysts warn that unpatched NAS systems remain prime targets for cybercriminals due to the valuable personal and business data they store. Western Digital advised users to enable automatic updates to ensure ongoing protection against emerging threats.
