Back to overview

CVE-2022-22995

CRITICAL
10.0
CVSS 3.1
Description
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

Metadata

CVE ID
CVE-2022-22995
State
PUBLISHED
Assigner
WDC PSIRT
Reserved
2022-01-10 00:00 UTC
Published
2022-03-25 00:00 UTC
Last updated
2025-11-03 21:45 UTC
Primary CWE
CWE-59
CWE-59 Improper Link Resolution Before File Access ('Link Fo…
Vendor / Product
Western Digital / My Cloud
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Affected products (2)
VendorProductPlatformVersions
Western Digital My Cloud Linux My Cloud OS 5 < 5.19.117
Western Digital My Cloud Home Android My Cloud Home < 7.16-220
Weakness (CWE)
CWESourceDescription
CWE-59 cna CWE-59 Improper Link Resolution Before File Access ('Link Following')
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
References (6)
Back to overview