VDB-334607 · Submit #698652 · CVE-2025-14187

UGREEN DH2100+ up to 5.3.0.251125 nas_svr /v1/file/backup/create handler_file_backup_create path buffer overflow

Summaryinfo

A vulnerability was found in UGREEN DH2100+ up to 5.3.0.251125. It has been rated as critical. This impacts the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. The manipulation of the argument path leads to buffer overflow. This vulnerability is uniquely identified as CVE-2025-14187. The attack is possible to be carried out remotely. Moreover, an exploit is present. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in UGREEN DH2100+ up to 5.3.0.251125 and classified as critical. This issue affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. The manipulation of the argument path with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability.

It is possible to read the advisory at notion.so. The identification of this vulnerability is CVE-2025-14187. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are required for exploitation. Technical details as well as a public exploit are known.

The exploit is available at notion.so. It is declared as proof-of-concept.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202512-829) and EUVD (EUVD-2025-201596). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

UGREEN

Name

DH2100+

Version

5.3.0.251125

CPE 2.3info

🔒

CPE 2.2info

🔒

CVSSv4info

VulDB Vector: 🔒
VulDB Reliability: 🔍

CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒

CVSSv3info

VulDB Meta Base Score: 7.2
VulDB Meta Temp Score: 6.8

VulDB Base Score: 7.2
VulDB Temp Score: 6.5
VulDB Vector: 🔒
VulDB Reliability: 🔍

CNA Base Score: 7.2
CNA Vector: 🔒

CVSSv2info

AV	AC	Au	C	I	A
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳

Vector	Complexity	Authentication	Confidentiality	Integrity	Availability
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍

Exploitinginfo

Class: Buffer overflow
CWE: CWE-120 / CWE-119
CAPEC: 🔒
ATT&CK: 🔒

Physical: No
Local: No
Remote: Yes

Availability: 🔒
Access: Public
Status: Proof-of-Concept
Download: 🔒

EPSS Score: 🔒
EPSS Percentile: 🔒

Price Prediction: 🔍
Current Price Estimation: 🔒

0-Day	Unlock	Unlock	Unlock	Unlock
Today	Unlock	Unlock	Unlock	Unlock

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Timelineinfo

11/28/2025 Countermeasure disclosed
12/06/2025 +8 days Advisory disclosed
12/06/2025 +0 days VulDB entry created
01/28/2026 +53 days VulDB entry last update