CVE-2025-14188
UGREEN DH2100+ nas_svr create handler_file_backup_create command injection
Vexday Risk Score
21Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 8.6EPSS 2.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
07 dez 2025Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
A security vulnerability has been detected in UGREEN DH2100+ up to 5.3.0.251125. This impacts the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. The manipulation of the argument path leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading the affected component is advised.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
UGREEN · DH2100+Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →