{"id":"CVE-2025-14693","state":"PUBLISHED","title":"Ugreen DH2100+ USB symlink","description":"A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulation leads to symlink following. The attack can be executed directly on the physical device. The exploit has been disclosed to the public and may be used. It is suggested to upgrade the affected component.","publishedAt":"2025-12-15T00:02:06.966Z","updatedAt":"2026-01-28T06:49:07.795Z","severity":{"score":7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Ugreen DH2100+"],"affected":[{"vendor":"Ugreen","product":"DH2100+","versions":[{"version":"5.0","status":"affected"},{"version":"5.1","status":"affected"},{"version":"5.2","status":"affected"},{"version":"5.3.0","status":"affected"}],"modules":["USB Handler"]}],"references":["https://vuldb.com/?id.336411","https://vuldb.com/?ctiid.336411","https://vuldb.com/?submit.704646","https://vuldb.com/?submit.704657","https://www.notion.so/2bc6cf4e528a8083bf3fc6f7a953f0a1"],"weaknesses":["CWE-61","CWE-59"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/14xxx/CVE-2025-14693.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-14693","state":"PUBLISHED","datePublished":"2025-12-15T00:02:06.966Z","dateUpdated":"2026-01-28T06:49:07.795Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-12-14T10:48:51.666Z"},"containers":{"cna":{"title":"Ugreen DH2100+ USB symlink","descriptions":[{"lang":"en","value":"A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulation leads to symlink following. The attack can be executed directly on the physical device. The exploit has been disclosed to the public and may be used. It is suggested to upgrade the affected component."}],"affected":[{"vendor":"Ugreen","product":"DH2100+","versions":[{"version":"5.0","status":"affected"},{"version":"5.1","status":"affected"},{"version":"5.2","status":"affected"},{"version":"5.3.0","status":"affected"}],"modules":["USB Handler"]}],"references":[{"url":"https://vuldb.com/?id.336411","name":"VDB-336411 | Ugreen DH2100+ USB symlink","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.336411","name":"VDB-336411 | CTI Indicators (IOB, IOC)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.704646","name":"Submit #704646 | Ugreen NAS DH2100+ V5.3.0 Incorrect Access Control","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.704657","name":"Submit #704657 | Ugreen Ugreen NAS DH2100+ V5.3.0 Incorrect Access Control (Duplicate)","tags":["third-party-advisory"]},{"url":"https://www.notion.so/2bc6cf4e528a8083bf3fc6f7a953f0a1","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":6.2,"vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.2,"vectorString":"CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:L/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-61","type":"CWE","lang":"en","description":"Symlink Following"}]},{"descriptions":[{"cweId":"CWE-59","type":"CWE","lang":"en","description":"Link Following"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-01-28T06:49:07.795Z"},"timeline":[{"time":"2025-12-14T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-12-14T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-01-28T07:52:33.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"rgyue (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-15T19:35:07.000915Z","id":"CVE-2025-14693","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-15T19:35:39.780Z"}}]}}}