by Kastro
Paper/Archive/CVE-2022-22995

CVE-2022-22995

Western Digital My Cloud — Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk

EPSS 3%CVSS 10.0
critical.is priorityof 100
47
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 86.1.861 × 2017.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

Affected

ProductAffectedFixed inSource
My CloudMy Cloud OS 5 – < 5.19.117 5.19.117CNA
My Cloud HomeMy Cloud Home – < 7.16-220 7.16-220CNA

Scores by source

WDC PSIRT (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwesterndigital.com/support/product-security/wdc-22005-netatalk-security-vulnerabilitiesadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGOadvisorysecurity.gentoo.org/glsa/202311-02advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKWreflists.debian.org/debian-lts-announce/2024/01/msg00000.htmlreflists.debian.org/debian-lts-announce/2024/11/msg00026.html