CVE-2022-22995
Critical
Description
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
SeverityCritical
CVSS10.0
Exploit probability—
Product
Westerndigital My Cloud Pr2100 Firmware
PublishedMar 25, 2022
First seenMar 25, 2022
Weakness typeCWE-59Improper link resolution
How to fix
Update
- westerndigital my_cloud_pr2100_firmware5.19.117 or later
- westerndigital my_cloud_pr4100_firmware5.19.117 or later
- westerndigital my_cloud_ex4100_firmware5.19.117 or later
- westerndigital my_cloud_ex2_ultra_firmware5.19.117 or later
- westerndigital my_cloud_mirror_gen_2_firmware5.19.117 or later
- westerndigital my_cloud_dl2100_firmware5.19.117 or later
- westerndigital my_cloud_dl4100_firmware5.19.117 or later
- westerndigital my_cloud_ex2100_firmware5.19.117 or later
- westerndigital my_cloud_firmware5.19.117 or later
- westerndigital wd_cloud_firmware5.19.117 or later
- westerndigital my_cloud_home_firmware7.16-220 or later
- netatalk netatalk3.1.18 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/
- security.gentoo.org/glsa/202311-02
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| westerndigital my_cloud_pr2100_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_pr4100_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_ex4100_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_ex2_ultra_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_mirror_gen_2_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_dl2100_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_dl4100_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_ex2100_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital wd_cloud_firmware | v < 5.19.117 | 5.19.117 |
| westerndigital my_cloud_home_firmware | v < 7.16-220 | 7.16-220 |
| netatalk netatalk | v < 3.1.18 | 3.1.18 |
| fedoraproject fedora | 37, 38, 39 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.