CVE-2025-14224CWE-22path-traversal

CVE-2025-14224

Medium · published December 8, 2025

CVSS v3.1
4.3
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00769 · 55.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-12-08T14:15Z
Affected products (3)
ProductVersionsFixed in
yottamaster/dm2_firmware≤ 1.9.12—
yottamaster/dm3_firmware≤ 1.9.12—
yottamaster/dm200_firmware≤ 1.2.23—
References (5)
https://vuldb.com/?ctiid.334666 · [email protected]https://vuldb.com/?id.334666 · [email protected]https://vuldb.com/?submit.701673 · [email protected]https://www.notion.so/2b76cf4e528a80f6ae50fe21b13ff0b8 · [email protected]https://www.notion.so/Yottamaster-NAS-Unauth-Operation-2b76cf4e528a80f6ae50fe21b13ff0b8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 DEC 08:32Z
    Yottamaster DM2/DM3/DM200 File Upload path traversal
    cvelistv5