$ cve CVE-2022-22995 JSON

CVE-2022-22995

10.0

CRITICAL · CVSS 3.1 · EPSS 2.7% (pctl 86)

In your normal cycle

Critical by CVSS (10), but no sign of active exploitation.

Description

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

Scoring

CVSS	10.0 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
EPSS	2.74% — more likely to be exploited than 86% of all CVEs
Weakness	CWE-59
On CISA KEV	no
Public exploit	none known
Published	2022-03-25
Last modified	2026-06-17

Affected (24)

Vendor	Product
fedoraproject	fedora
netatalk	netatalk
westerndigital	my cloud
westerndigital	my cloud dl2100
westerndigital	my cloud dl2100 firmware
westerndigital	my cloud dl4100
westerndigital	my cloud dl4100 firmware
westerndigital	my cloud ex2 ultra
westerndigital	my cloud ex2 ultra firmware
westerndigital	my cloud ex2100
westerndigital	my cloud ex2100 firmware
westerndigital	my cloud ex4100
westerndigital	my cloud ex4100 firmware
westerndigital	my cloud firmware
westerndigital	my cloud home
westerndigital	my cloud home firmware
westerndigital	my cloud mirror gen 2
westerndigital	my cloud mirror gen 2 firmware
westerndigital	my cloud pr2100
westerndigital	my cloud pr2100 firmware
westerndigital	my cloud pr4100
westerndigital	my cloud pr4100 firmware
westerndigital	wd cloud
westerndigital	wd cloud firmware

References

→ the Explorer · watch your stack · NVD