Western Digital My Cloud EX2 storage devices leak files on a local network by default. The problem is tied to the embedded UPnP media server that is automatically started when the device is powered on. Unauthenticated users can grab any files from the device completely bypassing any permissions or restrictions set by the owner or administrator. Trustwave recommends turning off DLNA to protect user data. In February, researchers at Trustwave disclosed other vulnerabilities in Western Digital NAS devices could be exploited by a local attacker to gain root access to the NAS devices.”]
Source: https://securityaffairs.co/wordpress/71780/security/western-digital-my-cloud-flaw.html