I do understand that basically all Versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability. And there is even PoC Code to check if a specific server is vulnerable by myself. But I do not understand in what exact circumstances a server is vulnerable. Rapid7 wants to tell who is affected, but does not provide a concrete answer to this.
Some source tells that the attacker has to have authorized access with write-permissions. But this information does not satisfy me. What is the exact combination of states and events that lets an attacker exploit this vulnerability?