CVE-2022-23121

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-755

Affected software

No affected versions have been published.

Timeline

Published: Mar 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-231229.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required t CVE-2022-231239.8This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not re CVE-2022-231249.8This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not re CVE-2022-231259.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required t CVE-2022-231269.8TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Drivin CVE-2022-231276.1Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions CVE-2022-231289.8Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), CVE-2022-231295.5Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS6 CVE-2022-23137.3A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and o CVE-2022-231305.5Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and p CVE-2022-231319.8In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, beca CVE-2022-231327.3During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case