CVE-2022-22995

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
Western Digital	My Cloud	>= My Cloud OS 5, < 5.19.117
Western Digital	My Cloud Home	>= My Cloud Home, < 7.16-220

References

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229967.8The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arb CVE-2022-229979.8Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially CVE-2022-229987.5Implemented protections on AWS credentials that were not properly protected.CVE-2022-229994.8Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privil CVE-2022-23005.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-230007.8The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. T CVE-2022-230015.3When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with CVE-2022-230025.3When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properl CVE-2022-230035.3When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output CVE-2022-230045.3When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is CVE-2022-230058.7Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in CVE-2022-230066.7A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow