// For flags

CVE-2022-22995

Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

La combinación de primitivas que ofrecen SMB y AFP en su configuración por defecto permite la escritura arbitraria de archivos. Al explotar esta combinación de primitivas, un atacante puede ejecutar código arbitrario

*Credits: Corentin BAYET (@OnlyTheDuck), Etienne HELLUY-LAFONT and Luca MORO (@johncool__) from Synacktiv working with Trend Micro’s Zero Day Initiative
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-01-10 CVE Reserved
  • 2022-03-25 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-10-29 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-59: Improper Link Resolution Before File Access ('Link Following')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Westerndigital
Search vendor "Westerndigital"
My Cloud Pr2100 Firmware
Search vendor "Westerndigital" for product "My Cloud Pr2100 Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Pr2100 Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Pr2100
Search vendor "Westerndigital" for product "My Cloud Pr2100"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Pr4100 Firmware
Search vendor "Westerndigital" for product "My Cloud Pr4100 Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Pr4100 Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Pr4100
Search vendor "Westerndigital" for product "My Cloud Pr4100"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Ex4100 Firmware
Search vendor "Westerndigital" for product "My Cloud Ex4100 Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Ex4100 Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Ex4100
Search vendor "Westerndigital" for product "My Cloud Ex4100"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Ex2 Ultra Firmware
Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Ex2 Ultra
Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Mirror Gen 2 Firmware
Search vendor "Westerndigital" for product "My Cloud Mirror Gen 2 Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Mirror Gen 2 Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Mirror Gen 2
Search vendor "Westerndigital" for product "My Cloud Mirror Gen 2"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Dl2100 Firmware
Search vendor "Westerndigital" for product "My Cloud Dl2100 Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Dl2100 Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Dl2100
Search vendor "Westerndigital" for product "My Cloud Dl2100"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Dl4100 Firmware
Search vendor "Westerndigital" for product "My Cloud Dl4100 Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Dl4100 Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Dl4100
Search vendor "Westerndigital" for product "My Cloud Dl4100"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Ex2100 Firmware
Search vendor "Westerndigital" for product "My Cloud Ex2100 Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Ex2100 Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Ex2100
Search vendor "Westerndigital" for product "My Cloud Ex2100"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Firmware
Search vendor "Westerndigital" for product "My Cloud Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "My Cloud Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud
Search vendor "Westerndigital" for product "My Cloud"
--
Safe
Westerndigital
Search vendor "Westerndigital"
Wd Cloud Firmware
Search vendor "Westerndigital" for product "Wd Cloud Firmware"
< 5.19.117
Search vendor "Westerndigital" for product "Wd Cloud Firmware" and version " < 5.19.117"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
Wd Cloud
Search vendor "Westerndigital" for product "Wd Cloud"
--
Safe
Westerndigital
Search vendor "Westerndigital"
My Cloud Home Firmware
Search vendor "Westerndigital" for product "My Cloud Home Firmware"
< 7.16-220
Search vendor "Westerndigital" for product "My Cloud Home Firmware" and version " < 7.16-220"
-
Affected
in Westerndigital
Search vendor "Westerndigital"
My Cloud Home
Search vendor "Westerndigital" for product "My Cloud Home"
--
Safe
Netatalk
Search vendor "Netatalk"
Netatalk
Search vendor "Netatalk" for product "Netatalk"
< 3.1.18
Search vendor "Netatalk" for product "Netatalk" and version " < 3.1.18"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
37
Search vendor "Fedoraproject" for product "Fedora" and version "37"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
38
Search vendor "Fedoraproject" for product "Fedora" and version "38"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
39
Search vendor "Fedoraproject" for product "Fedora" and version "39"
-
Affected