CVEvulnerability

CVE-2022-22995

9.8 CRITICAL Published 2022-03-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-59

Description

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

Affected configurations

• westerndigital my cloud pr2100 firmware (< 5.19.117) • westerndigital my cloud pr4100 firmware (< 5.19.117) • westerndigital my cloud ex4100 firmware (< 5.19.117) • westerndigital my cloud ex2 ultra firmware (< 5.19.117) • westerndigital my cloud mirror gen 2 firmware (< 5.19.117) • westerndigital my cloud dl2100 firmware (< 5.19.117) • westerndigital my cloud dl4100 firmware (< 5.19.117) • westerndigital my cloud ex2100 firmware (< 5.19.117) • westerndigital my cloud firmware (< 5.19.117) • westerndigital wd cloud firmware (< 5.19.117) • westerndigital my cloud home firmware (< 7.16-220) • netatalk netatalk (< 3.1.18) • fedoraproject fedora 37 • fedoraproject fedora 38 • fedoraproject fedora 39

Related

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References