A decade-old bug let hackers factory-reset every WD My Book Live

Western Digital's My Book Live network-attached storage device shipped with an administrator API that could trigger a full factory reset without a password — a flaw introduced in April 2011 during a refactor of the device's authentication logic and never caught before the product reached the end of its supported life in 2015.

On June 24, 2021, owners around the world found their photos, videos and other stored files gone. Device logs showed a script called factoryRestore.sh had run, wiping the drives. Researchers traced the wipes to two vulnerabilities exploited at once: an older bug, CVE-2018-18472, that one attacker used to build a botnet out of compromised devices, and the newer, unauthenticated reset flaw, CVE-2021-35941, that a rival attacker used to sabotage that botnet by wiping the same devices out from under it.

Because My Book Live had been out of active support since 2015, the vulnerable authentication code sat unpatched for roughly a decade before it was exploited. Western Digital told owners to disconnect the devices from the internet immediately, and from July 2021 offered data recovery services to customers who had lost files.