CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-22995
Critical (9.8). EPSS 2.7% chance of exploitation in the next 30 days.
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
Severity
- EPSS
- 2.7% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-59
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- netatalk:netatalk
- westerndigital:my_cloud_dl2100_firmware
- westerndigital:my_cloud_dl4100_firmware
- westerndigital:my_cloud_ex2100_firmware
- westerndigital:my_cloud_ex2_ultra_firmware
- westerndigital:my_cloud_ex4100_firmware
- westerndigital:my_cloud_firmware
- westerndigital:my_cloud_home_firmware
- westerndigital:my_cloud_mirror_gen_2_firmware
- westerndigital:my_cloud_pr2100_firmware
- westerndigital:my_cloud_pr4100_firmware
- westerndigital:wd_cloud_firmware
References
- https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/
- https://security.gentoo.org/glsa/202311-02