{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-14693","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-12-14T10:48:51.666Z","datePublished":"2025-12-15T00:02:06.966Z","dateUpdated":"2026-01-28T06:49:07.795Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-01-28T06:49:07.795Z"},"title":"Ugreen DH2100+ USB symlink","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-61","lang":"en","description":"Symlink Following"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-59","lang":"en","description":"Link Following"}]}],"affected":[{"vendor":"Ugreen","product":"DH2100+","versions":[{"version":"5.0","status":"affected"},{"version":"5.1","status":"affected"},{"version":"5.2","status":"affected"},{"version":"5.3.0","status":"affected"}],"modules":["USB Handler"]}],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulation leads to symlink following. The attack can be executed directly on the physical device. The exploit has been disclosed to the public and may be used. It is suggested to upgrade the affected component."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":6.2,"vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.2,"vectorString":"CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:L/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C"}}],"timeline":[{"time":"2025-12-14T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-12-14T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-01-28T07:52:33.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"rgyue (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.336411","name":"VDB-336411 | Ugreen DH2100+ USB symlink","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.336411","name":"VDB-336411 | CTI Indicators (IOB, IOC)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.704646","name":"Submit #704646 | Ugreen NAS DH2100+ V5.3.0 Incorrect Access Control","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.704657","name":"Submit #704657 | Ugreen Ugreen NAS DH2100+ V5.3.0 Incorrect Access Control (Duplicate)","tags":["third-party-advisory"]},{"url":"https://www.notion.so/2bc6cf4e528a8083bf3fc6f7a953f0a1","tags":["exploit"]}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-15T19:35:07.000915Z","id":"CVE-2025-14693","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-15T19:35:39.780Z"}}]}}