CVE-2025-69430
Incorrect Symlink Follow in Yottamaster NAS Enables File Tampering
Publication date: 2026-02-03
Last updated on: 2026-02-11
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yottamaster | dm2_firmware | to 1.9.12 (inc) |
| yottamaster | dm3_firmware | to 1.9.12 (inc) |
| yottamaster | dm200_firmware | to 1.2.23 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Incorrect Symlink Follow issue found in multiple Yottamaster NAS devices, including DM2, DM3, and DM200 models with certain firmware versions. Attackers can exploit this by formatting a USB drive to ext4, creating a symbolic link to the root directory of the USB drive, and then inserting it into the NAS device. When the NAS mounts the USB drive, the attacker can access the symlink directory on the NAS, which allows them to view and tamper with all files within the NAS system.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and modification of the internal file system of the affected NAS devices. An attacker exploiting this flaw could leak sensitive data stored on the NAS or tamper with files, potentially causing data loss, corruption, or unauthorized disclosure of confidential information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know