References https://www.tenable.com/security/research/tra-2018-14 https://cve.imfht.com/detail/CVE-2018-1151?lang=en https://www.tenable.com/security/research/tra-2018-14 https://www.exploit-db.com/exploits/19402 https://www.bitdefender.com/en-us/blog/hotforsecurity/western-digital-tv-media-player-streams-multiple-security-flaws https://thehackernews.com/2011/07/wd-tv-live-hub-compromised-multiple.html https://www.bleepingcomputer.com/news/security/owners-of-wdtv-media-players-advised-to-take-devices-offline-due-to-security-bugs/ https://www.securityweek.com/researchers-disclose-unpatched-wd-tv-media-player-flaws/
Related VulnerabilitiesMediaWiki EasyTimeline远程代码执行漏洞(CVE-2026-8857)PoCharman-media-suite-lfi: Harman Media Suite <= 4.2.0 - Local File DisclosurePoCibm-websphere-ssrf: IBM WebSphere HCL Digital Experience - Server-Side Request ForgeryPoCCVE-2026-8857: MediaWiki EasyTimeline - Code Injection RCEZLMediaKit /index/ 未授权访问漏洞(CVE-2024-27488)PoCCVE-2020-36884: BrightSign Digital Signage 8.2.26 - Server-Side Request ForgeryBrightSign Digital Signage /speedtest SSRF 漏洞PoCCVE-2026-34885: WordPress Media Library Assistant <= 3.34 - SQL InjectionDevDojo Voyager /admin/media/upload 文件上传漏洞(CVE-2024-55417)PoCOpenMediaVault /rpc.php 默认口令漏洞PoCCVE-2024-13112: WP MediaTagger <= 4.1.1 - Cross-Site ScriptingPoCCVE-2022-0873: WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site ScriptingPoCCVE-2024-5057: WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection