← Back

CVE-2025-69430

nvd nist
Published: Feb 3, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 0.9 / Impact: 5.2
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or prior to V1.9.12), DM3 (version equal to or prior to V1.9.12), and DM200 (version equal to or prior to V1.2.23) that could be exploited by attackers to leak or tamper with the internal file system. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, then access the USB drive's symlink directory mounted on the NAS to obtain all files within the NAS system and tamper with those files.

Affected (3)

Yottamaster
3 products
Dm2 Firmware
Dm3 Firmware
Dm200 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Dm2 Firmware
Up to 1.9.12
Running on/withPlatform Versions
Yottamaster
Dm2
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Dm3 Firmware
Up to 1.9.12
Running on/withPlatform Versions
Yottamaster
Dm3
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Dm200 Firmware
Up to 1.2.23
Running on/withPlatform Versions
Yottamaster
Dm200
All versions

Related CWEs

CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (1)

Source: cve@mitre.org
ExploitThird Party Advisory

Timeline

No history available yet.