CVE-2025-14187 Overview
CVE-2025-14187 is a buffer overflow vulnerability affecting the UGREEN DH2100+ network-attached storage (NAS) device through firmware version 5.3.0.251125. The flaw resides in the handler_file_backup_create function reachable through the /v1/file/backup/create endpoint of the nas_svr component. An authenticated remote attacker can manipulate the path argument to trigger memory corruption [CWE-119]. Public exploit details have been disclosed, increasing the likelihood of opportunistic exploitation against exposed devices. The vulnerability carries an EPSS probability of 0.575% as of the latest scoring.
Critical Impact
Remote attackers with valid credentials can corrupt memory in the nas_svr service, potentially achieving code execution or service disruption on UGREEN DH2100+ NAS devices.
Affected Products
- UGREEN DH2100+ NAS firmware up to and including 5.3.0.251125
- nas_svr component handling /v1/file/backup/create requests
- handler_file_backup_create function processing the path parameter
Discovery Timeline
- 2025-12-07 - CVE-2025-14187 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-14187
Vulnerability Analysis
The vulnerability exists in the handler_file_backup_create function of the nas_svr daemon, which handles backup-creation requests submitted to /v1/file/backup/create. The handler processes a user-controlled path argument without enforcing adequate bounds on its length before copying it into a fixed-size buffer. This pattern matches the [CWE-119] classification: improper restriction of operations within the bounds of a memory buffer.
Successful exploitation can overwrite adjacent memory structures within the nas_svr process. Depending on the surrounding memory layout and platform mitigations, this can yield denial of service, control of the instruction pointer, or arbitrary code execution within the service's privilege context.
Root Cause
The root cause is missing or insufficient length validation on the path field before it is copied into a stack or heap buffer inside handler_file_backup_create. The function trusts attacker-supplied input from the JSON request body and writes beyond the allocated buffer boundary.
Attack Vector
Exploitation occurs over the network against the NAS device's HTTP API. The attacker requires high privileges, meaning a valid authenticated session is necessary before reaching the vulnerable endpoint. After authenticating, the attacker submits a crafted POST request to /v1/file/backup/create with an oversized path argument designed to overflow the destination buffer.
No user interaction is required beyond the attacker's own authenticated request. Public exploit information has been released through VulDB Entry #334607, reducing the technical barrier for reproduction.
Detection Methods for CVE-2025-14187
Indicators of Compromise
- Unexpected crashes, restarts, or core dumps from the nas_svr process on UGREEN DH2100+ devices.
- HTTP POST requests to /v1/file/backup/create containing abnormally long path values in the JSON body.
- Authenticated API sessions originating from unfamiliar IP addresses immediately prior to service instability.
Detection Strategies
- Inspect web server and reverse-proxy logs for requests to /v1/file/backup/create with path fields exceeding expected filesystem path lengths.
- Monitor system logs and watchdog events for nas_svr segmentation faults, abort signals, or automatic restarts.
- Correlate authentication events with subsequent backup API calls to surface anomalous administrative activity.
Monitoring Recommendations
- Forward NAS application and system logs to a centralized logging platform for retention and query.
- Alert on repeated 5xx responses or process restarts associated with the backup API endpoint.
- Track outbound connections from the NAS to non-corporate destinations, which may indicate post-exploitation activity.
How to Mitigate CVE-2025-14187
Immediate Actions Required
- Apply the firmware update published by UGREEN that supersedes version 5.3.0.251125 once available.
- Restrict management and API access to the NAS device to trusted administrative networks only.
- Rotate administrator credentials on the device, since exploitation requires authenticated access.
- Audit existing user accounts on the NAS and remove unused or shared administrative identities.
Patch Information
The vendor advisory referenced through VulDB CtiID #334607 recommends upgrading the affected nas_svr component to a fixed firmware release from UGREEN. Consult the UGREEN support portal for the specific firmware version that addresses CVE-2025-14187 on the DH2100+ platform.
Workarounds
- Block external access to the NAS HTTP API at the perimeter firewall and require VPN access for management.
- Disable the backup creation feature for non-administrative roles where the product permits granular permissions.
- Place the NAS device on an isolated VLAN with strict ACLs limiting which clients can reach the /v1/file/backup/create endpoint.
# Example perimeter restriction limiting NAS API to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
