CVE-2025-14224
📋 TL;DR
A path traversal vulnerability in Yottamaster DM2, DM3, and DM200 NAS devices allows attackers to upload files to arbitrary locations via the file upload component. This affects versions up to 1.2.23/1.9.12. Remote exploitation is possible without authentication.
💻 Affected Systems
- Yottamaster DM2
- Yottamaster DM3
- Yottamaster DM200
📦 What is this software?
Dm2 Firmware by Yottamaster
Dm200 Firmware by Yottamaster
Dm3 Firmware by Yottamaster
⚠️ Risk & Real-World Impact
Worst Case
Attackers could overwrite critical system files, install backdoors, or achieve remote code execution by uploading malicious files to sensitive directories.
Likely Case
Unauthorized file upload to arbitrary locations, potentially leading to data manipulation, privilege escalation, or denial of service.
If Mitigated
Limited impact if file upload functionality is disabled or restricted to authenticated users only.
🎯 Exploit Status
Exploit has been made public according to references. Remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider workarounds or replacement.
🔧 Temporary Workarounds
Disable file upload functionality
allIf possible, disable the vulnerable file upload component through device configuration.
Network segmentation
allIsolate affected NAS devices from untrusted networks and internet access.
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Monitor file upload activity and audit logs for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in web interface or via SSH if available. Versions ≤1.2.23/1.9.12 are vulnerable.Check Version:
Check web admin interface → System Information → Firmware VersionVerify Fix Applied:
No official fix available. Verify workarounds by testing file upload restrictions.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload requests
- Requests with path traversal patterns (../)
- Unauthenticated file upload attempts
Network Indicators:
- HTTP POST requests to file upload endpoints with path traversal payloads
SIEM Query:
source="nas_logs" AND (url="*upload*" AND (payload="*../*" OR user="anonymous"))