Samba vulnerabilities in embedded firmware: find the version and VFS modules, rank the CVEs, harden smb.conf

Samba ships wherever a device offers Windows file sharing over SMB: NAS boxes, routers with a USB storage port, media and home gateways, and industrial gateways that expose a share for log export or recipe transfer. NAS vendors build their file service on it, which is why Synology published its own advisory for the vfs_fruit flaw. Synology-SA-22:02 rates CVE-2021-44142 Important for DSM 6.2, fixed in 6.2.4-25556-4, and lists DSM 7.0 and its SRM 1.2 router firmware as not affected, a reminder that two products from the same vendor can carry different Samba builds.

On routers, the usual source is a build system package. OpenWrt's packages feed carries samba4, at version 4.24.5 in its package Makefile on 2026-11-14, and Buildroot and Yocto carry recipes too. Our embedded Linux build systems and SBOM guide explains how those recipes surface in an SBOM. Older or very small images can still carry a Samba 3.x build, often next to a BusyBox userland, and Samba links against the C library, so our glibc, uClibc and musl guide covers the layer underneath.

Three CVEs cover most of what a firmware scan of a Samba image turns up, and each depends on configuration as much as on version. Samba's security release list gives the date and affected releases for every advisory. Scores below are Samba's own CVSS from each announcement and NVD's; EPSS values are FIRST's for 2026-11-14, and KEV status is from CISA's catalog version 2026.11.13.

The score gap on CVE-2023-3961 is worth reading before ranking it. Samba scores it 6.8 with high attack complexity and integrity impact only, while NVD's 9.8 assumes full impact; Samba's announcement adds that no exploit was known when it was published.

The list is still active. As of 2026-11-14 the newest entry is dated 23 October 2026, CVE-2026-109411 in the vfs_ceph_rgw module, fixed in 4.25.1, and a 28 July 2026 security release covered six CVEs in the 4.24, 4.23 and 4.22 series. Per the Samba release planning page, each series gets six months of full support, six in maintenance and six of security fixes only: on 2026-11-14 that is 4.25 current, 4.24 in maintenance, 4.23 security only, and 4.22 and older end of life.

SambaCry turns any writable share into a code loader. Samba's announcement says every version from 3.5.0 onwards lets "a malicious client" upload a shared library to a writable share "and then cause the server to load and execute it". The workaround it gives, nt pipe support = no in the global section, stops clients from opening named pipe endpoints, which shows where the load is triggered, and Samba warns that it can break expected functionality for Windows clients.

The preconditions match a typical consumer NAS or USB-storage router: a share someone can write to, often a guest share for "plug in a drive and share it", and smbd running as root. A guest-writable share removes the need for any password. The flaw is old, but its exposure is not: CISA added it to the KEV catalog on 2023-03-30 and marks known ransomware campaign use, and its EPSS of 0.994 puts it among the most likely CVEs to see exploitation attempts. Our KEV and EPSS prioritisation guide explains how to weigh those two signals.

Old builds can be fixed without a new major version. Samba published patches for older releases alongside 4.6.4, and the Debian tracker for CVE-2017-7494 shows the fix backported to Samba 3.6.6 in wheezy (2:3.6.6-6+deb7u13, DLA-951-1) and to 4.2.14 in jessie (DSA-3860-1).

The vfs_fruit flaw is a NAS problem because vfs_fruit is the module that makes a share work well for Macs and Time Machine, a feature NAS boxes and storage routers advertise. Samba's announcement places the bug in the parsing of EA metadata when smbd opens files, requiring write access to a file's extended attributes, and notes that this "could be a guest or unauthenticated user" when guests may write. The vulnerable path is the default configuration of the module, fruit:metadata=netatalk or fruit:resource=file; only when both are set to non-default values is a system unaffected.

The vfs_fruit manual confirms fruit:resource = file and fruit:metadata = netatalk as defaults. That matters for generated configurations: OpenWrt's samba4 init script adds catia fruit streams_xattr to a share's vfs objects and sets fruit:metadata = stream when its macOS option is on, but leaves fruit:resource at the default, so an unpatched build with that option still meets Samba's affected condition. The workaround is to remove fruit from every vfs objects line, at the cost of macOS metadata becoming unreadable.

Backports work here too. The Debian tracker for CVE-2021-44142 shows bullseye fixed at 2:4.13.13+dfsg-1~deb11u3 and buster at 2:4.9.5+dfsg-5+deb10u3 (DSA-5071-1), both below the upstream 4.13.17 fix, which is exactly the case where a plain version match reports a false positive.

CVE-2023-3961 is a path traversal in how smbd maps SMB named pipes to local sockets, and it only exists in Samba 4.16.0 and later. Samba's announcement explains that since 4.16.0 smbd connects client pipe names opened through the IPC$ share to unix domain sockets in a private directory, but did not sanitize names containing ../. Because smbd connects as root, a client could reach any service listening on a unix domain socket elsewhere on the file system, with possible denial of service, crashes or compromise depending on that service. Samba lists no workaround.

On a device, that turns every local daemon with a unix socket into potential attack surface reachable over SMB. The fix shipped in 4.17.12, 4.18.8 and 4.19.1 on 2023-10-10. Older images are out of range: the Debian tracker for CVE-2023-3961 marks buster and bullseye as not affected because the vulnerable code is absent. Our path traversal in embedded firmware guide covers the same class of bug in vendor code, such as web interfaces that build file paths from request parameters.

SMBv1 exposure depends on the version and on what the vendor sets. The Samba 4.11.0 release notes changed the defaults of client min protocol and server min protocol to SMB2_02, so clients without SMB2 or SMB3 support can no longer connect by default. A device on Samba 3.x or an early 4.x release accepts SMB1 unless its configuration says otherwise.

Products also turn it back on for old clients such as legacy media players or scanners. OpenWrt's samba4 service writes server min protocol = NT1, lanman auth = yes and ntlm auth = ntlmv1-permitted when its allow_legacy_protocols option is set, and logs a warning not to use that option in secure environments. Check the effective configuration for NT1 or lower, and treat any SMB1 listener reachable beyond the LAN as a finding in its own right.

Most Samba exposure on devices comes from defaults chosen for easy sharing, not security. OpenWrt's template, for example, sets map to guest = Bad User and null passwords = yes, where the smb.conf manual defaults are Never and no; on the positive side it already sets bind interfaces only = yes and turns printing off. A device baseline looks like this:

[global]
    # No guest logins, no empty passwords
    map to guest = Never
    null passwords = no
    restrict anonymous = 2

    # SMB2 or newer only; NTLMv2 only
    server min protocol = SMB2_02
    ntlm auth = ntlmv2-only

    # Listen on the LAN bridge only
    interfaces = lo br-lan
    bind interfaces only = yes

    # No print server, no NetBIOS unless a client needs it
    load printers = no
    disable spoolss = yes
    disable netbios = yes

    # No symlinks out of a share
    allow insecure wide links = no

[share]
    path = /mnt/usb
    read only = no
    guest ok = no
    valid users = @smbusers
    wide links = no
    # Only the modules this share needs; leave out fruit unless Macs need it
    vfs objects = streams_xattr

Adjust it to the version and product. Raise server min protocol to SMB3_00 if every client supports SMB3. disable netbios = yes hides the device from clients that browse only through NetBIOS; server smb transports, or its synonym smb ports, can limit smbd to TCP port 445. If Mac support is a product requirement, keep fruit only on a patched build and only on the shares that need it. Never port-forward 445 or 139 to the WAN, and make sure the device firewall blocks them on WAN interfaces regardless of bind interfaces only, which the manual says must not be relied on as a security feature for nmbd. Ship no shared default share password; our hard-coded credentials guide covers per-device credentials.

SoftWSP's automated scan unpacks a firmware image, catalogs the software packages in the extracted file system with their versions (the inventory our firmware SBOM guide describes), and matches each one against CVE records, CISA's KEV catalog and FIRST's EPSS scores. On OpenWrt-style images the opkg package revision is stripped before matching. This is deterministic code: the code scores, and AI narrates. You can inspect the resulting CycloneDX file in the free SBOM viewer.

Version matching follows NVD's records and inherits their limits, which are significant for Samba. NVD files Samba CVEs under cpe:2.3:a:samba:samba with ranges per series, which a package named samba4-server has to be mapped to, and OpenWrt declares cpe:/a:samba:samba for that reason. A version also cannot show whether fruit is loaded, whether a share is writable by guests or whether a distribution backport closed the bug. AI's part is the written explanation of what matched, citing the component, version and record behind each sentence. An engineer reviews every finding before the report is delivered, and that review is where loaded VFS modules, share permissions, the protocol floor, listening interfaces and any vendor or distribution backport become a documented "affected" or "fixed" decision.

For where file-sharing services fit in a full assessment, see the OWASP Firmware Security Testing Methodology guide and our OpenSSH vulnerabilities in embedded firmware guide for the other common network daemon, or device & firmware security services to have a specific image reviewed.

This guide draws on Samba's security release list, its announcements for CVE-2017-7494, CVE-2021-44142, CVE-2023-3961 and CVE-2026-109411, the Samba 4.11.0 release notes, the smb.conf and vfs_fruit manuals and the Samba release planning page, Synology-SA-22:02, the Debian Security Tracker, the OpenWrt samba4 package files, NVD, CISA's KEV catalog (version 2026.11.13) and FIRST EPSS data dated 2026-11-14, all read directly on 2026-11-14.