PT-2025-49401 · Ugreen · Ugreen Dh2100+

Published 2025-12-07 · Updated 2026-01-28 · CVE-2025-14188

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UGREEN DH2100+ versions through 5.3.0.251125

Description A security issue exists in UGREEN DH2100+ that allows for remote command injection. The issue is related to the handler file backup create function within the nas svr component, specifically through manipulation of the path argument in the '/v1/file/backup/create' API endpoint. The exploit has been publicly disclosed.

Recommendations Versions through 5.3.0.251125 should be updated when a fixed version is available. As a temporary workaround, consider restricting access to the '/v1/file/backup/create' API endpoint until a patch is available.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-14188

Affected Products

Ugreen Dh2100+

References · 12

• 🔥 https://notion.so/25e2b76e8e0c80578014fff04a950576 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14188 · Security Note
• https://vuldb.com/?ctiid.334608 · Note
• https://t.me/cveNotify/145026 · Telegram Post
• https://t.me/cveNotify/150083 · Telegram Post
• https://twitter.com/offseq/status/1997909605268287981 · Twitter Post
• https://twitter.com/CVEnew/status/1997630316241170813 · Twitter Post
• https://twitter.com/cracbot/status/1999071736097378622 · Twitter Post
• https://t.me/CVEtracker/39040 · Telegram Post
• https://vuldb.com/?submit.698833 · Note
• https://vuldb.com/?id.334608 · Note
• https://twitter.com/VulmonFeeds/status/1997629797623636410 · Twitter Post