Skip to main content

My Cloud Pr2100 Firmware CVE-2022-22995

CRITICAL
Improper Link Resolution Before File Access (CWE-59)
2022-03-25 psirt@wdc.com
RCE My Cloud Pr2100 Firmware My Cloud Pr4100 Firmware My Cloud Ex4100 Firmware My Cloud Ex2 Ultra Firmware My Cloud Mirror Gen 2 Firmware My Cloud Dl2100 Firmware My Cloud Dl4100 Firmware My Cloud Ex2100 Firmware My Cloud Firmware Wd Cloud Firmware My Cloud Home Firmware Netatalk Fedora
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Mar 25, 2022 - 23:15 nvd
CRITICAL 9.8

DescriptionNVD

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

AnalysisAI

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-59. The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code. Affected products include: Westerndigital My Cloud Pr2100 Firmware, Westerndigital My Cloud Pr4100 Firmware, Westerndigital My Cloud Ex4100 Firmware, Westerndigital My Cloud Ex2 Ultra Firmware, Westerndigital My Cloud Mirror Gen 2 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in My Cloud Pr2100 Firmware

View all
CVE-2018-17153 CRITICAL POC
9.8 Sep 18

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulne
CVE-2019-9949 HIGH POC
8.8 May 23

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmwar
CVE-2019-9951 CRITICAL
9.8 Apr 24

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, M
CVE-2019-9950 CRITICAL
9.8 Apr 24

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, M
CVE-2022-23000 HIGH
7.8 Jul 25

The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port
CVE-2022-22999 MEDIUM
4.8 Jul 25

Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2015-1130 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8
CVE-2024-57728 HIGH POC
7.2
CVE-2025-21391 HIGH
7.1
CVE-2025-48384 HIGH
8.0
CVE-2024-28189 CRITICAL POC
10.0

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2022-22995 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy