What this actually is.
Technical background, root cause, and affected surface.
A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Low
- CVSS Score
- 3.7
- Status
- Published
- CWE
- CWE-484: Omitted Break Statement in Switch
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
libatalk/dsi/dsi_opensess.c: switch(option) block missing break between cases, causing fallthrough to next case handler
Root cause: Missing break statement in switch/case block in DSI OpenSession option processing
When does this fire?
All conditions must be true for the exploit to succeed.
Attacker sends a DSI OpenSession request with a specific option value that triggers the fall-through case
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Unintended code path execution during AFP session establishment; minor DoS
C:N · I:N · A:L
CWE-484: Omitted Break Statement in Switch
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds the missing break statement.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.