CVE-2022-22995

Published: Mar 25, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

Affected (15)

Products: Westerndigital: My Cloud Pr2100 Firmware, My Cloud Pr4100 Firmware, My Cloud Ex4100 Firmware, My Cloud Ex2 Ultra Firmware, My Cloud Mirror Gen 2 Firmware, My Cloud Dl2100 Firmware, My Cloud Dl4100 Firmware, My Cloud Ex2100 Firmware, My Cloud Firmware, Wd Cloud Firmware, My Cloud Home Firmware · Fedoraproject: Fedora · Netatalk: Netatalk

Westerndigital

11 products

My Cloud Pr2100 Firmware

My Cloud Pr4100 Firmware

My Cloud Ex4100 Firmware

My Cloud Ex2 Ultra Firmware

My Cloud Mirror Gen 2 Firmware

My Cloud Dl2100 Firmware

My Cloud Dl4100 Firmware

My Cloud Ex2100 Firmware

My Cloud Firmware

Wd Cloud Firmware

My Cloud Home Firmware

1 product

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Pr2100 Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud Pr2100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Pr4100 Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud Pr4100	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Ex4100 Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud Ex4100	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Ex2 Ultra Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud Ex2 Ultra	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Mirror Gen 2 Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud Mirror Gen 2	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Dl2100 Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud Dl2100	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Dl4100 Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud Dl4100	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Ex2100 Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud Ex2100	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital My Cloud	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital Wd Cloud Firmware	Before 5.19.117

Running on/with	Platform Versions
Westerndigital Wd Cloud	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Westerndigital My Cloud Home Firmware	Before 7.16-220

Running on/with	Platform Versions
Westerndigital My Cloud Home	All versions

Configuration L

4 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 37
Fedoraproject Fedora	Version 38
Fedoraproject Fedora	Version 39
Netatalk Netatalk	Before 3.1.18

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (13)

https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html

Source: psirt@wdc.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/

Source: psirt@wdc.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/

Source: psirt@wdc.com

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/

Source: psirt@wdc.com

Mailing List

https://security.gentoo.org/glsa/202311-02

Source: psirt@wdc.com

Issue TrackingThird Party Advisory

https://www.westerndigital.com/support/product-security/wdc-22005-netatalk-security-vulnerabilities

Source: psirt@wdc.com

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html