What is the CVSS score of CVE-2025-14188?

CVE-2025-14188 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of UGREEN DH2100 are affected by CVE-2025-14188?

UGREEN NAS devices (DH2100+ models running firmware up to 5.3.0.251125) are vulnerable to remote command injection through the backup function, allowing attackers to execute arbitrary commands…

How to fix or mitigate CVE-2025-14188?

Within 24 hours: Identify all UGREEN DH2100+ devices in your environment and document firmware versions; disable remote access to the backup API endpoint if operationally feasible. Within 7 days: Implement network segmentation to restrict access to affected NAS devices to trusted internal networks only; monitor access logs for suspicious backup API calls. Within 30 days: Contact UGREEN support for patch availability timeline; evaluate replacement or migration of critical data from affected devices if patches remain unavailable; conduct audit of backup configurations for unauthorized changes.

UGREEN DH2100 CVE-2025-14188

EUVD-2025-201598 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-07 cna@vuldb.com

Command Injection

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:50 euvd

EUVD-2025-201598

Analysis Generated

Mar 15, 2026 - 17:50 vuln.today

CVE Published

Dec 07, 2025 - 11:15 nvd

HIGH 7.2

DescriptionCVE.org

A security vulnerability has been detected in UGREEN DH2100+ up to 5.3.0.251125. This impacts the function handler_file_backup_create of the file /v1/file/backup/create of the component nas_svr. The manipulation of the argument path leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading the affected component is advised.

Analysis

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells.

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.