A Lovely 10C Site!

The undocumented vulnerability resided in a file aptly named systemfactoryrestore. It contains a PHP script that performs resets, allowing users to restore all default configurations and wipe all data stored on the devices.

Normally, and for good reason, factory resets require the person making the request to provide a user password. This authentication ensures that devices exposed to the Internet can only be reset by the legitimate owner and not by a malicious hacker.

This WD My Book situation is getting a lot more worse…

There's even code that shows how it's exploited.