Log in Start free

Vulnerability · Published Mar 25, 2022 · Assigned by WDC PSIRT

CVE-2022-22995Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk

Critical 10.0

In plain English

A critical-severity security flaw in My Cloud from Western Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.7%top 13.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20netatalk3.1.18-r0ALPINE-CVE-2022-22995
Alpine:v3.21netatalk3.1.18-r0ALPINE-CVE-2022-22995
Alpine:v3.22netatalk3.1.18-r0ALPINE-CVE-2022-22995
Alpine:v3.23netatalk3.1.18-r0ALPINE-CVE-2022-22995
Alpine:v3.24netatalk3.1.18-r0ALPINE-CVE-2022-22995
Debian:13netatalk3.1.18~ds-1DEBIAN-CVE-2022-22995
Debian:14netatalk3.1.18~ds-1DEBIAN-CVE-2022-22995

Affected products (as reported)

VendorProductVersions
Western Digital My Cloud My Cloud OS 5 – before 5.19.117
Western Digital My Cloud Home My Cloud Home – before 7.16-220

Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References