title: Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk
description: The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
problem types: CWE-59 Improper Link Resolution Before File Access ('Link Following')
affected:
{
vendor: Western Digital
product: My Cloud
versions:
version: My Cloud OS 5, status: affected, lessThan:  5.19.117, versionType: custom
platforms: Linux
}
{
vendor: Western Digital
product: My Cloud Home
versions:
version: My Cloud Home, status: affected, lessThan:  7.16-220, versionType: custom
platforms: Android
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 10
baseSeverity: CRITICAL
]
solutions: To take advantage of the latest security fixes, Western Digital recommends that users promptly update their devices to the latest firmware by clicking on the firmware update notification.