CVE-2025-14187

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-14187
A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:M/C:C/I:C/A:C

Exploitability : 6.4 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://vuldb.com/?ctiid.334607
https://vuldb.com/?id.334607
https://vuldb.com/?submit.698652
https://www.notion.so/2b16cf4e528a80bbb5fdeff145f110ec
Configurations

No configuration.

History

28 Jan 2026, 07:15

Type Values Removed Values Added
Summary (en) A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. (en) A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component.

07 Dec 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-07 09:15

Updated : 2026-01-28 07:15

NVD link : CVE-2025-14187

Mitre link : CVE-2025-14187

CVE.ORG link : CVE-2025-14187

JSON object : View

Products Affected

No product.

CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')