CVE-2021-35941: Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrato...

Security readout for executives and security teams

This CVE describes an unauthenticated factory-reset function in Western Digital My Book Live and My Book Live Duo NAS devices. In June 2021, attackers used it to wipe devices in the wild. The main business risk is destructive data loss, especially where these older storage devices remain reachable from untrusted networks. Exposure is limited to environments that still operate WD My Book Live 2.x or later, or WD My Book Live Duo devices. Risk is highest if devices are internet reachable or accessible from untrusted network segments. Prioritize asset discovery and data recovery readiness. This is a destructive vulnerability with confirmed historical exploitation, but the source bundle does not show current exploitation or a documented patch path. Mitigation focus: Identify any WD My Book Live or My Book Live Duo devices in use.; Follow Western Digital's published security measures for these products.; Remove affected devices from untrusted network exposure pending vendor guidance..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.