{"id":"CVE-2022-22995","aliases":["ALPINE-CVE-2022-22995","DEBIAN-CVE-2022-22995","DLA-3706-1","DLA-3968-1","EUVD-2022-28106","GHSA-wc8x-f5rv-3653","MGASA-2024-0201","SUSE-SU-2023:4084-1","UBUNTU-CVE-2022-22995","USN-6786-1"],"status":"published","title":"Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02735,"percentile":0.86218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2022-03-25T00:00:00Z","modified":"2026-11-03T08:03:49Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"netatalk","fixed_in":["3.1.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"netatalk","fixed_in":["3.1.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"netatalk","fixed_in":["3.1.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"netatalk","fixed_in":["3.1.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"netatalk","fixed_in":["3.1.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"netatalk","fixed_in":["3.1.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"netatalk","fixed_in":["3.1.18-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"netatalk","fixed_in":["3.1.18~ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"netatalk","fixed_in":["3.1.18~ds-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"netatalk","fixed_in":["3.1.12~ds-3+deb10u5"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"netatalk","fixed_in":["3.1.14-2.3.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"netatalk","fixed_in":["3.1.0-3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"netatalk","fixed_in":["3.1.0-3.22.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netatalk","fixed_in":["3.1.12~ds-4ubuntu0.20.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netatalk","fixed_in":["3.1.12~ds-9ubuntu0.22.04.3+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18~ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18~ds-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12~ds-3+deb10u5"}]}],"versions":["3.1.12~ds-3","3.1.12~ds-3+deb10u1","3.1.12~ds-3+deb10u2","3.1.12~ds-3+deb10u3","3.1.12~ds-3+deb10u4"]},{"source":"osv","ecosystem":"Debian:11","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12~ds-8+deb11u2"}]}],"versions":["3.1.12~ds-8","3.1.12~ds-8+deb11u1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.3.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.22.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12~ds-4ubuntu0.20.04.3+esm1"}]}],"versions":["3.1.12~ds-3","3.1.12~ds-4","3.1.12~ds-4ubuntu0.20.04.1","3.1.12~ds-4ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12~ds-9ubuntu0.22.04.3+esm1"}]}],"versions":["3.1.12~ds-9","3.1.12~ds-9build1","3.1.12~ds-9ubuntu0.22.04.1","3.1.12~ds-9ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12~ds-4ubuntu0.20.04.3+esm1"}]}],"versions":["3.1.12~ds-3","3.1.12~ds-4","3.1.12~ds-4ubuntu0.20.04.1","3.1.12~ds-4ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netatalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12~ds-9ubuntu0.22.04.3+esm1"}]}],"versions":["3.1.12~ds-9","3.1.12~ds-9build1","3.1.12~ds-9ubuntu0.22.04.1","3.1.12~ds-9ubuntu0.22.04.3"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netatalk","product":"netatalk"},{"vendor":"western digital","product":"my cloud"},{"vendor":"western digital","product":"my cloud home"},{"vendor":"westerndigital","product":"my_cloud_dl2100_firmware"},{"vendor":"westerndigital","product":"my_cloud_dl4100_firmware"},{"vendor":"westerndigital","product":"my_cloud_ex2100_firmware"},{"vendor":"westerndigital","product":"my_cloud_ex2_ultra_firmware"},{"vendor":"westerndigital","product":"my_cloud_ex4100_firmware"},{"vendor":"westerndigital","product":"my_cloud_firmware"},{"vendor":"westerndigital","product":"my_cloud_home_firmware"},{"vendor":"westerndigital","product":"my_cloud_mirror_gen_2_firmware"},{"vendor":"westerndigital","product":"my_cloud_pr2100_firmware"},{"vendor":"westerndigital","product":"my_cloud_pr4100_firmware"},{"vendor":"westerndigital","product":"wd_cloud_firmware"}],"references":[{"url":"https://www.westerndigital.com/support/product-security/wdc-22005-netatalk-security-vulnerabilities","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/","tags":["vendor-advisory","x_transferred","Mailing List","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/","tags":["vendor-advisory","x_transferred","Mailing List","article"]},{"url":"https://security.gentoo.org/glsa/202311-02","tags":["vendor-advisory","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/","tags":["vendor-advisory","x_transferred","Mailing List","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00026.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22995"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2"},{"url":"https://github.com/advisories/GHSA-wc8x-f5rv-3653"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-22995","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-22995","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0201.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33249","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6786-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234084-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197576","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22995","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-22995","tags":["report"]},{"url":"https://netatalk.sourceforge.io/CVE-2022-22995.php","tags":["report"]},{"url":"https://github.com/Netatalk/netatalk/pull/509","tags":["report"]},{"url":"https://github.com/Netatalk/netatalk/commit/9eb6d9d0ac17dca210ccbf05476a925a6b379dfb","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22995","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-22995","title":"Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","status":"published","published":"2022-03-25T00:00:00Z","modified":"2025-11-03T21:45:48.606Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:34:26.645563Z"}],"euvd":[{"id":"EUVD-2022-28106","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","status":"published","published":"2022-03-25T00:00:00Z","modified":"2025-11-03T21:45:48Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T19:49:31.7352Z"}],"ghsa":[{"id":"GHSA-wc8x-f5rv-3653","title":"The combination of primitives offered by SMB and AFP in their default configuration allows the...","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","status":"published","published":"2022-03-27T00:00:38Z","modified":"2025-11-04T00:31:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:04:28.385807Z"}],"nvd":[{"id":"CVE-2022-22995","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","status":"published","published":"2022-03-25T23:15:08.41Z","modified":"2026-06-17T04:29:18.95Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:07:14.24948Z"}],"osv":[{"id":"ALPINE-CVE-2022-22995","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","status":"published","published":"2022-03-25T23:15:08.41Z","modified":"2026-11-03T07:31:19.69702128Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"CVE-2022-22995","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","status":"published","published":"2022-03-25T23:15:08.41Z","modified":"2026-10-24T10:30:27.219868841Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DEBIAN-CVE-2022-22995","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","status":"published","published":"2022-03-25T23:15:08.41Z","modified":"2026-11-03T08:03:49.906135077Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"UBUNTU-CVE-2022-22995","description":"The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.","status":"published","published":"2022-03-25T23:15:00Z","modified":"2026-02-04T02:40:32.081206Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-3706-1","title":"netatalk - security update","status":"published","published":"2024-01-04T00:00:00Z","modified":"2026-03-09T01:19:45.296172Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3968-1","title":"netatalk - security update","status":"published","published":"2024-11-28T00:00:00Z","modified":"2026-03-09T01:19:09.061926Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0201","title":"Updated netatalk packages fix security vulnerability","description":"The combination of primitives offered by SMB and AFP in their default\nconfiguration allows the arbitrary writing of files. By exploiting these\ncombination of primitives, an attacker can execute arbitrary code.\n","status":"published","published":"2024-05-31T15:15:28Z","modified":"2026-04-16T04:40:55.330206819Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2023:4084-1","title":"Security update for netatalk","description":"This update for netatalk fixes the following issues:\n\n- CVE-2022-22995: Fixed a flaw where combining primitives offered by SMB and AFP in their default configuration may allow an attacker to achieve arbitrary code execution. (bsc#1197576)\n","status":"published","published":"2023-10-16T09:31:51Z","modified":"2026-02-04T02:50:28.199323Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6786-1","title":"netatalk vulnerabilities","description":"It was discovered that Netatalk did not properly protect an SMB and AFP \ndefault configuration. A remote attacker could possibly use this issue to \nexecute arbitrary code.\n","status":"published","published":"2024-05-28T06:01:48Z","modified":"2026-04-27T17:13:58.939866Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}