Ugreen DH2100 CVE-2025-14693

Q: What is the CVSS score of CVE-2025-14693?

CVE-2025-14693 has a CVSS 4.0 base score of 5.2 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2025-12-15 cna@vuldb.com

Information Disclosure

5.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.2 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:15 vuln.today

DescriptionCVE.org

A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulation leads to symlink following. The attack can be executed directly on the physical device. The exploit has been disclosed to the public and may be used. It is suggested to upgrade the affected component.

AnalysisAI

Symlink following in the USB Handler of Ugreen DH2100+ firmware up to 5.3.0 enables a physically present attacker with high privileges to achieve full system compromise. Exploit code is publicly available but the attack cannot be executed remotely and requires administrative access. The low EPSS score (0.01%) reflects the limited exploitation conditions.