Cyber Posture

CVE-2025-14224

MediumPublic PoC

Published: 08 December 2025

Published
08 December 2025
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0028 51.6th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The…

more

exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly validates file paths and names in the upload component to block path traversal sequences like ../.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, prioritization, and remediation of the path traversal flaw in affected Yottamaster NAS versions.

AC-3 Access Enforcement partial match
prevent

Enforces access control policies on file system resources to deny writes to unauthorized paths even if traversal occurs.

Security SummaryAI

CVE-2025-14224 is a path traversal vulnerability (CWE-22) in the File Upload component of Yottamaster DM2, DM3, and DM200 NAS devices, affecting versions up to 1.2.23 or 1.9.12. The flaw arises from unspecified functionality within the file upload process that allows manipulation resulting in path traversal.

Remote exploitation is possible by low-privileged users (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful attacks achieve limited integrity impact (I:L) with no confidentiality or availability effects, as reflected in the CVSS v3.1 base score of 4.3 (S:U).

Advisories from VulDB indicate the exploit has been publicly disclosed and is available for use. The vendor was notified early about the issue but provided no response, suggesting no patches or official mitigations are currently available.

In context, the public availability of the exploit increases the risk for exposed Yottamaster NAS deployments, particularly those accessible remotely with low-privilege accounts.

Details

CWE(s)
CWE-22

Affected Products

yottamaster
dm2 firmware
≤ 1.9.12
yottamaster
dm3 firmware
≤ 1.9.12
yottamaster
dm200 firmware
≤ 1.2.23

MITRE ATT&CK Enterprise TechniquesAI

T1006 Direct Volume Access Stealth
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Path traversal in file upload/rename enables direct volume access (T1006), exploitation of public-facing NAS for initial access (T1190), and vertical privilege escalation via unauthorized file operations (T1068).

References