CVE-2022-22995criticalCWE-59

CVE-2022-22995: critical vulnerability in Western Digital My Cloud

Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk

Published · Updated

Follow this CVE+ Monitor My Cloud+ Monitor My Cloud Home

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 2.7%
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Affected products
Western Digital · My CloudWestern Digital · My Cloud Home
Related CVEs — Western Digital My Cloud

In the same product, most dangerous first.

CVE-2022-29844MEDIUMWestern Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftpEPSS 36.4%CVE-2022-22990HIGHLimited authentication bypass vulnerability on Western Digital My Cloud devicesEPSS 2.2%CVE-2022-22994HIGHInsufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.EPSS 1.9%CVE-2022-22997MEDIUMCommand Injection Vulnerability on My Cloud HomeEPSS 1.5%CVE-2022-22989CRITICALPre-authenticated stack overflow vulnerability on FTP ServiceEPSS 1.4%CVE-2022-22991HIGHCommand injection through unsecured HTTP calls on Western Digital My Cloud devicesEPSS 1.3%