CVE-2025-14224

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-14224
A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://vuldb.com/?ctiid.334666 Permissions Required VDB Entry
https://vuldb.com/?id.334666 Third Party Advisory VDB Entry
https://vuldb.com/?submit.701673 Third Party Advisory VDB Entry
https://www.notion.so/2b76cf4e528a80f6ae50fe21b13ff0b8 Exploit Third Party Advisory
https://www.notion.so/Yottamaster-NAS-Unauth-Operation-2b76cf4e528a80f6ae50fe21b13ff0b8 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:yottamaster:dm2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:yottamaster:dm2:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:yottamaster:dm3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:yottamaster:dm3:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:yottamaster:dm200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:yottamaster:dm200:-:*:*:*:*:*:*:*
History

01 Oct 2026, 16:10

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en Yottamaster DM2, DM3 y DM200 hasta las versiones 1.2.23/1.9.12. Este problema afecta a alguna funcionalidad desconocida del componente de Carga de Archivos. Realizar una manipulación resulta en un salto de ruta. La explotación remota del ataque es posible. El exploit se ha hecho público y podría utilizarse. Se contactó con el proveedor con antelación sobre esta divulgación, pero no respondió de ninguna manera.
Information

Published : 2025-12-08 09:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-14224

Mitre link : CVE-2025-14224

CVE.ORG link : CVE-2025-14224

JSON object : View

Products Affected

yottamaster

  • dm3_firmware
  • dm200_firmware
  • dm2_firmware
  • dm200
  • dm2
  • dm3
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')