PT-2025-49400 · Ugreen · Ugreen Dh2100+

Renguangyue · Published 2025-12-07 · Updated 2026-01-28 · CVE-2025-14187

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UGREEN DH2100+ versions through 5.3.0.251125

Description A flaw exists in UGREEN DH2100+ that could allow for remote buffer overflow. The issue is related to the handler file backup create function within the nas svr component, specifically when handling the path argument through the /v1/file/backup/create API endpoint. Manipulation of the path argument can trigger the overflow. The exploit for this issue has been publicly released.

Recommendations Versions through 5.3.0.251125 should be updated when a fixed version is available. As a temporary workaround, consider restricting access to the /v1/file/backup/create API endpoint.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2025-14187

Affected Products

Ugreen Dh2100+

References · 11

• 🔥 https://notion.so/2b16cf4e528a80bbb5fdeff145f110ec · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14187 · Security Note
• https://t.me/cveNotify/150082 · Telegram Post
• https://twitter.com/CVEnew/status/1997590703644283298 · Twitter Post
• https://t.me/cveNotify/145025 · Telegram Post
• https://vuldb.com/?submit.698652 · Note
• https://twitter.com/VulmonFeeds/status/1997601611393180047 · Twitter Post
• https://vuldb.com/?id.334607 · Note
• https://twitter.com/cracbot/status/1999071734268584007 · Twitter Post
• https://vuldb.com/?ctiid.334607 · Note
• https://t.me/CVEtracker/39039 · Telegram Post