CVE-2025-14224
criticalA vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12.
Vendor / product: Yottamaster — dm2 firmware
A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-12-08 09:15
Modified: 2026-10-07 20:10
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
yottamaster / dm2_firmware ≤1.9.12
yottamaster / dm3_firmware ≤1.9.12
yottamaster / dm200_firmware ≤1.2.23
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://vuldb.com/?ctiid.334666 cna@vuldb.com
- https://vuldb.com/?id.334666 cna@vuldb.com
- https://vuldb.com/?submit.701673 cna@vuldb.com
- https://www.notion.so/2b76cf4e528a80f6ae50fe21b13ff0b8 cna@vuldb.com
- https://www.notion.so/Yottamaster-NAS-Unauth-Operation-2b76cf4e528a80f6ae50fe21b13ff0b8 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗