CVE-2022-22995 Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk

2022-03-2500:00:00

CWE-59

WDC PSIRT

www.cve.org

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

9.9 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.8%

JSON

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

CNA Affected

[
  {
    "vendor": "Western Digital",
    "product": "My Cloud",
    "versions": [
      {
        "version": "My Cloud OS 5",
        "status": "affected",
        "lessThan": " 5.19.117",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Linux"
    ]
  },
  {
    "vendor": "Western Digital",
    "product": "My Cloud Home",
    "versions": [
      {
        "version": "My Cloud Home",
        "status": "affected",
        "lessThan": " 7.16-220",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Android "
    ]
  }
]