{"id":"CVE-2025-14187","aliases":["EUVD-2025-201596","GHSA-mx5f-4vx4-2f5r"],"status":"published","title":"UGREEN DH2100+ nas_svr create handler_file_backup_create buffer overflow","description":"A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00678,"percentile":0.52818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-120"],"published":"2025-12-07T08:32:07Z","modified":"2026-09-25T23:10:00Z","products":[{"vendor":"ugreen","product":"dh2100+"}],"references":[{"url":"https://vuldb.com/?id.334607","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.334607","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.698652","tags":["third-party-advisory"]},{"url":"https://www.notion.so/2b16cf4e528a80bbb5fdeff145f110ec","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14187"},{"url":"https://github.com/advisories/GHSA-mx5f-4vx4-2f5r"}],"sources":{"cve":[{"id":"CVE-2025-14187","title":"UGREEN DH2100+ nas_svr create handler_file_backup_create buffer overflow","description":"A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component.","status":"published","published":"2025-12-07T08:32:07.027Z","modified":"2026-01-28T06:48:53.137Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"},{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"},{"version":"2.0","score":8.3,"vector":"AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-120","CWE-119"],"updated_at":"2026-11-02T14:32:28.621398Z"}],"euvd":[{"id":"EUVD-2025-201596","description":"A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component.","status":"published","published":"2025-12-07T08:32:07Z","modified":"2026-01-28T06:48:53Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T19:48:46.416428Z"}],"ghsa":[{"id":"GHSA-mx5f-4vx4-2f5r","title":"A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function...","description":"A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-12-07T09:30:18Z","modified":"2025-12-07T09:30:18Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:05:04.429575Z"}],"nvd":[{"id":"CVE-2025-14187","description":"A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component.","status":"published","published":"2025-12-07T09:15:48.307Z","modified":"2026-09-25T23:10:00.463Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":8.3,"vector":"AV:N/AC:L/Au:M/C:C/I:C/A:C","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-120"],"updated_at":"2026-11-02T14:11:49.093461Z"}]}}