PT-2026-5970 · Orico · Orico Nas Cd3510

Published 2026-02-03 · Updated 2026-02-06 · CVE-2025-69429

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ORICO NAS CD3510 versions V1.9.12 and below

Description The ORICO NAS CD3510 is affected by an Incorrect Symlink Follow issue. This allows attackers to potentially leak or modify the internal file system. An attacker can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device, and then access the USB drive’s symlink directory mounted on the NAS to obtain and tamper with files within the NAS system.

Recommendations Update ORICO NAS CD3510 to a version later than V1.9.12.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-69429

Affected Products

Orico Nas Cd3510

References · 4

• 🔥 https://notion.so/ORICO-NAS-Incorrect-Symlink-Follow-2c36cf4e528a80b7bf0be4dcac758419?source=copy_link · Exploit
• https://osv.dev/vulnerability/CVE-2025-69429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69429 · Security Note
• https://t.me/cveNotify/151210 · Telegram Post