Netatalk EUVD-2026-31230

Attacker must have network reachability to the Netatalk AFP service (default TCP/548) AND valid low-privilege credentials accepted by an enabled UAM (PR:L per CVSS), running a vulnerable Netatalk build in the 3.1.4-4.4.2 range. The CVSS AC:H rating indicates non-trivial conditions to trigger the bitwise-OR logic path - likely a specific sequence or input shape rather than a one-shot payload - limiting opportunistic exploitation. UI:N means no victim interaction is needed once the attacker is authenticated, but exposure is naturally limited because AFP is most often firewalled to LAN/management segments and is being phased out on modern macOS in favor of SMB.

Signals are mixed and warrant prioritization rather than emergency response. The CVSS 7.5 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable bug that nonetheless requires high attack complexity and low-privilege authentication (PR:L), which significantly narrows the realistic attacker pool - typically a user already permitted to mount an AFP share. EPSS data was not provided in the input, KEV status is not asserted, and no public exploit is referenced, so exploitation appears speculative rather than imminent. However, OS command injection in a daemon that frequently runs as root or with elevated file-system privileges has high blast radius if it is triggered, and AFP services on NAS devices are routinely exposed on LAN segments - meaning insider abuse or a foothold on an adjacent host could realize the impact. No CISA KEV entry, no POC, and AC:H/PR:L collectively suggest a serious but non-urgent patching priority.

An attacker who possesses any valid AFP login - for example a low-privileged employee account or credentials harvested from a phishing campaign - connects to the exposed Netatalk daemon over TCP/548 and submits a crafted protocol request whose payload exercises the flawed bitwise-OR branch. The resulting shell injection executes commands in the security context of afpd, typically allowing the attacker to read arbitrary files on the share host, plant a reverse shell, or pivot deeper into the storage network. No public PoC has been published at the time of analysis, so a working exploit would have to be developed from the advisory.