CVE-2022-22995: Fedoraproject Fedora

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

Affected products

• Fedoraproject Fedora: version 37 only; version 38 only; version 39 only
• Netatalk Netatalk: before 3.1.18 (fixed in 3.1.18)
• Westerndigital My Cloud DL2100 Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital My Cloud DL4100 Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital My Cloud EX2100 Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital My Cloud EX2 Ultra Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital My Cloud EX4100 Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital My Cloud Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital My Cloud Home Firmware: before 7.16-220 (fixed in 7.16-220)
• Westerndigital My Cloud Mirror Gen 2 Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital My Cloud PR2100 Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital My Cloud PR4100 Firmware: before 5.19.117 (fixed in 5.19.117)
• Westerndigital Wd Cloud Firmware: before 5.19.117 (fixed in 5.19.117)

Published 2022-03-25. Last modified 2026-06-17.