What’s Vulnerable › Vulnerabilities

CVE-2025-14224: Yottamaster DM2/DM3/DM200 File Upload path traversal

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-08 · updated 2026-10-07
• Weakness: CWE-22

Description

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• Yottamaster Dm200 Firmware: through 1.2.23
• Yottamaster Dm2 Firmware: through 1.9.12
• Yottamaster Dm3 Firmware: through 1.9.12

References

• https://vuldb.com/?ctiid.334666
• https://vuldb.com/?id.334666
• https://vuldb.com/?submit.701673
• https://www.notion.so/2b76cf4e528a80f6ae50fe21b13ff0b8
• https://www.notion.so/Yottamaster-NAS-Unauth-Operation-2b76cf4e528a80f6ae50fe21b13ff0b8

Get alerted when CVE-2025-14224 or the next vulnerability affects your stack