Home

Description

A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component.

PUBLISHED Reserved 2025-12-06 | Published 2025-12-07 | Updated 2026-01-28 | Assigner VulDB




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
HIGH: 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
HIGH: 7.2CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
8.3AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C

Problem types

Buffer Overflow

Memory Corruption

Product status

5.3.0.251125
affected

Timeline

2025-11-28:Countermeasure disclosed
2025-12-06:Advisory disclosed
2025-12-06:VulDB entry created
2026-01-28:VulDB entry last update

Credits

renguangyue (VulDB User) reporter

References

vuldb.com/?id.334607 (VDB-334607 | UGREEN DH2100+ nas_svr create handler_file_backup_create buffer overflow) vdb-entry technical-description

vuldb.com/?ctiid.334607 (VDB-334607 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.698652 (Submit #698652 | UGREEN DH2100+ NAS V4.2.0.601 Buffer Overflow) third-party-advisory

www.notion.so/2b16cf4e528a80bbb5fdeff145f110ec exploit

cve.org (CVE-2025-14187)

nvd.nist.gov (CVE-2025-14187)

Download JSON