CVE-2025-14224

MediumPublic PoCUpdated

Published: 08 December 2025

Published

08 December 2025

Modified

29 April 2026

KEV Added

—

Patch

—

CVSS Score 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS Score 0.0038 59.5th percentile

Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14224 is a medium-severity Path Traversal (CWE-22) vulnerability in Yottamaster Dm2 Firmware. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Direct Volume Access (T1006); ranked in the top 40.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Direct Volume Access (T1006) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly validates file paths and names in the upload component to block path traversal sequences like ../.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, prioritization, and remediation of the path traversal flaw in affected Yottamaster NAS versions.

AC-3 Access Enforcement partial match

prevent

Enforces access control policies on file system resources to deny writes to unauthorized paths even if traversal occurs.

MITRE ATT&CK Enterprise TechniquesAI

T1006 Direct Volume Access Stealth

Adversaries may directly access a volume to bypass file access controls and file system monitoring.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Path traversal in file upload/rename enables direct volume access (T1006), exploitation of public-facing NAS for initial access (T1190), and vertical privilege escalation via unauthorized file operations (T1068).

NVD Description

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The…

exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2025-14224 is a path traversal vulnerability (CWE-22) in the File Upload component of Yottamaster DM2, DM3, and DM200 NAS devices, affecting versions up to 1.2.23 or 1.9.12. The flaw arises from unspecified functionality within the file upload process that allows manipulation resulting in path traversal.

Remote exploitation is possible by low-privileged users (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful attacks achieve limited integrity impact (I:L) with no confidentiality or availability effects, as reflected in the CVSS v3.1 base score of 4.3 (S:U).

Advisories from VulDB indicate the exploit has been publicly disclosed and is available for use. The vendor was notified early about the issue but provided no response, suggesting no patches or official mitigations are currently available.

In context, the public availability of the exploit increases the risk for exposed Yottamaster NAS deployments, particularly those accessible remotely with low-privilege accounts.