WD My Cloud EX2 Ultra (WDBVBZ0000NCH)

WD My Cloud EX2 Ultra (WDBVBZ0000NCH)
Security Grade D Calculator v1	Western Digital My Cloud EX2 Ultra (WDBVBZ0000NCH) Brand: Western Digital Category: NAS • Model / Gen: WDBVBZ0000NCH Release Date: 2016-01-01 • Status: End of life Classification Date: 2026-10-28 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	—	Consumer NAS with hot-swappable drive bays and no tamper-resistant enclosure; disks can be physically removed.
Known vulnerabilities	Very common	—	~64 tracked CVEs, including CVE-2021-35941 (unauthenticated remote code execution). Source: nvd.nist.gov/vuln/detail/CVE-2021-35941
Prior attacks	Very common	—	CVE-2021-35941 is in CISA's Known Exploited Vulnerabilities catalog; My Cloud devices have been mass-exploited in the wild. Source: www.hkcert.org/security-bulletin/western-digital-my-cloud-remote-code-execution-vulnerability_20220328
Updatability	Rare	—	My Cloud OS 5 still receives patches but they are infrequent for this 2016-era hardware. Source: www.cisa.gov/known-exploited-vulnerabilities-catalog
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—	Shares (SMB/NFS) and cloud require credentials, but legacy services (UPnP/DLNA) accept unauthenticated access. Source: nvd.nist.gov/vuln/detail/CVE-2021-35941
Communications	Encrypted with obselete encryption	—	HTTPS/TLS for cloud and admin, but legacy local protocols and older TLS remain in use. Source: nvd.nist.gov/vuln/detail/CVE-2021-35941
Storage	No encryption	—	No hardware/full-disk encryption on the EX2 Ultra; data at rest on the disks is plaintext.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Basic	—	Multiple user accounts are supported but with coarse, limited role granularity.
Authentication	Basic	—	Username/password only; older My Cloud OS 3 shipped with a default admin with no password.
Brute-force protection	Basic	—	Limited login rate-limiting; accounts can be brute-forced.
Event logging	Partial logging	—	Basic access/connection logging; limited security-event auditing.
Passwords	Require change after setup	—	Password must be set at first setup, but no enforced complexity and no forced rotation.
Category Score	Score: 2 / 3