In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application’s process through library injection by using DYLD environment variables.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15816
Reference (s):
- https://www.westerndigital.com/support/productsecurity/wdc-20005-wd-discovery-remote-command-execution-vulnerability