CVE-2025-14224

LowPublic PoC

Published: 08 December 2025

Published

08 December 2025

Modified

29 April 2026

KEV Added

—

Patch

—

CVSS Score v4 2.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0038 59.8th percentile

Risk Priority 4 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14224 is a low-severity Path Traversal (CWE-22) vulnerability in Yottamaster Dm2 Firmware. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Direct Volume Access (T1006); ranked in the top 40.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-14224 is a path traversal vulnerability (CWE-22) in the File Upload component of Yottamaster DM2, DM3, and DM200 NAS devices, affecting versions up to 1.2.23 or 1.9.12. The flaw arises from unspecified functionality within the file upload process that allows manipulation resulting in path traversal.

Remote exploitation is possible by low-privileged users (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful attacks achieve limited integrity impact (I:L) with no confidentiality or availability effects, as reflected in the CVSS v3.1 base score of 4.3 (S:U).

Advisories from VulDB indicate the exploit has been publicly disclosed and is available for use. The vendor was notified early about the issue but provided no response, suggesting no patches or official mitigations are currently available.

In context, the public availability of the exploit increases the risk for exposed Yottamaster NAS deployments, particularly those accessible remotely with low-privilege accounts.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-201680

Vulnerability details

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The…

exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1006 Direct Volume Access Stealth

Adversaries may directly access a volume to bypass file access controls and file system monitoring.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Path traversal in file upload/rename enables direct volume access (T1006), exploitation of public-facing NAS for initial access (T1190), and vertical privilege escalation via unauthorized file operations (T1068).