CVE-2025-69429
Unknown Unknown - Not Provided

Incorrect Symlink Follow in ORICO NAS CD3510 Enables File Tampering

Publication date: 2026-02-03

Last updated on: 2026-02-11

Assigner: MITRE

Description
The ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow vulnerability that could be exploited by attackers to leak or tamper with the internal file system. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, then access the USB drive's symlink directory mounted on the NAS to obtain all files within the NAS system and tamper with those files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-03
Last Modified
2026-02-11
Generated
2026-07-06
AI Q&A
2026-02-04
EPSS Evaluated
2026-07-05
NVD
CVE-2025-69429

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
orico cd3510_firmware to 1.9.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The ORICO NAS CD3510 (version V1.9.12 and below) has an Incorrect Symlink Follow vulnerability. This means that an attacker can exploit the way the device handles symbolic links on USB drives. Specifically, an attacker can format a USB drive to the ext4 file system, create a symbolic link pointing to the root directory of the USB drive, and then insert this drive into the NAS device. When the NAS mounts the USB drive, the attacker can access the symlink directory on the NAS, which allows them to access and potentially tamper with all files within the NAS system.

Impact Analysis

This vulnerability can lead to unauthorized access and modification of files stored on the NAS device. An attacker exploiting this flaw could leak sensitive information by accessing internal files or tamper with critical data, potentially causing data loss, corruption, or unauthorized disclosure.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart