WD Discovery App Flaw Exposes Windows Users
A high security vulnerability has been discovered in Western Digital’s WD Discovery application, exposing Windows users to potential arbitrary code execution attacks.
The flaw, identified as CVE-2025-30248, affects version 5.2.730 and earlier versions of the popular disk management software.
The security flaw stems from a DLL hijacking vulnerability in the WD Discovery installer.
This weakness allows local attackers to execute malicious code by placing a specially crafted DLL file within the installer’s search path.
| Attribute | Details |
|---|---|
| CVE ID | CVE-2025-30248 |
| Affected Product | Western Digital WD Discovery |
| Affected Version | 5.2.730 and earlier |
| Vulnerability Type | DLL Hijacking |
| CVSS 4.0 Score | 8.9 (HIGH) |
The vulnerability exploits an uncontrolled search path element (CWE-427), enabling unauthorized code execution during the installation process.
Western Digital has released WD Discovery version 5.3 to address this vulnerability along with additional security improvements.
The update resolves both DLL search order hijacking and EXE/DLL hijacking issues found in the Tiny Installer component.
Users will receive automatic update prompts, or they can manually download the patched version from Western Digital’s official downloads page.
The company credits security researchers Kazuma Matsumoto from GMO Cybersecurity by IERAE, Inc., and David Silva for responsibly disclosing these vulnerabilities.
Windows users running WD Discovery should immediately update to version 5.3 or later to protect against potential exploitation attempts.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…