CVE-2025-14188
BaseFortify
Publication date: 2025-12-07
Last updated on: 2025-12-08
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ugreen | dh2100+ | 5.3.0.251125 |
| ugreen | dh2100+ | 4.2.0.601 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the UGREEN DH2100+ device up to version 5.3.0.251125, specifically in the function handler_file_backup_create of the /v1/file/backup/create component. It allows an attacker to remotely perform command injection by manipulating the 'path' argument, potentially executing arbitrary commands on the device.
How can this vulnerability impact me? :
The vulnerability can lead to remote command execution on the affected device, which may result in unauthorized access, data compromise, disruption of services, or complete control over the device by an attacker.
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or patches exist for this vulnerability. The vendor did not respond to the disclosure. The suggested immediate mitigation is to replace the affected product to avoid exploitation. [1]