CVE-2025-69430 is an Incorrect Symlink Follow vulnerability affecting Yottamaster NAS devices, specifically DM2, DM3 (both V1.9.12 and earlier), and DM200 (V1.2.23 and earlier). An attacker can exploit this by creating a specially formatted USB drive with a symbolic link, then inserting it into the NAS to gain full read and write access to the device's internal file system. With a CVSS score of 6.1 (MEDIUM), the vulnerability requires physical access (AV:P) but is easy to exploit (AC:L) with no user interaction (UI:N), leading to high confidentiality and integrity impacts (C:H, I:H). Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.9.12CPE matchmatch criteria | cpe:2.3:o:yottamaster:dm2_firmware:*:*:*:*:*:*:*:* | ||
<= 1.9.12CPE matchmatch criteria | cpe:2.3:o:yottamaster:dm3_firmware:*:*:*:*:*:*:*:* | ||
<= 1.2.23CPE matchmatch criteria | cpe:2.3:o:yottamaster:dm200_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.