Yottamaster manufactures a line of external storage enclosures and network-attached storage devices, including the DM2 and DM3 product families, where the observed vulnerability signals center on path-traversal and link-following weaknesses in firmware components. These file-system access-control issues reflect the risk inherent to storage appliances that expose file operations to network clients, and defenders should prioritize firmware updates for exposed devices. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Yottamaster over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-14224CRITICAL A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manip | Dec 8, 2025 | 9.8 | 31 | NO | NO |
CVE-2025-69430MEDIUM An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or prior to V1.9.12), DM3 (version equal to or prior to V1.9.1 | Feb 3, 2026 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Yottamaster.
Media articles that mention a CVE ID that affects a product developed by Yottamaster — matched by CVE ID, not by vendor name.