---
id: CVE-2025-14224
title: >-
  A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to
  1.2.23/1.9.12
summary: >-
  A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to
  1.2.23/1.9.12. Affected by this issue is some unknown functionality of the
  component File Upload. Performing manipulation results in path traversal.
  Remote exploitation of…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-22
vendor: yottamaster
product: dm2_firmware
affected:
  - dm2_firmware <= 1.9.12
  - dm3_firmware <= 1.9.12
  - dm200_firmware <= 1.2.23
published: '2025-12-08'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T20:10:01.970'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14224'
references:
  - url: 'https://vuldb.com/?ctiid.334666'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.334666'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.701673'
    label: cna@vuldb.com
  - url: 'https://www.notion.so/2b76cf4e528a80f6ae50fe21b13ff0b8'
    label: cna@vuldb.com
  - url: >-
      https://www.notion.so/Yottamaster-NAS-Unauth-Operation-2b76cf4e528a80f6ae50fe21b13ff0b8
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00769
epssPercentile: 0.554
ingestedAt: '2026-10-01T18:55:42.303Z'
---

## Overview

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `dm2_firmware <= 1.9.12`
- `dm3_firmware <= 1.9.12`
- `dm200_firmware <= 1.2.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.