What is the CVSS score of CVE-2025-69429?

CVE-2025-69429 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cd3510 Firmware are affected by CVE-2025-69429?

CVE-2025-69429 presents moderate security risk rated CVSS 6.1. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.

Is there a public PoC exploit available for CVE-2025-69429?

Yes, a public proof-of-concept exploit is available for CVE-2025-69429. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-69429?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Cd3510 Firmware CVE-2025-69429

MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-02-03 cve@mitre.org

Path Traversal Cd3510 Firmware

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 11, 2026 - 16:40 vuln.today

Public exploit code

CVE Published

Feb 03, 2026 - 18:16 nvd

MEDIUM 6.1

DescriptionCVE.org

The ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow vulnerability that could be exploited by attackers to leak or tamper with the internal file system. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, then access the USB drive's symlink directory mounted on the NAS to obtain all files within the NAS system and tamper with those files.

AnalysisAI

Technical ContextAI

Classified as CWE-59 (Improper Link Resolution Before File Access). Affects Cd3510 Firmware. The ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow vulnerability that could be exploited by attackers to leak or tamper with the internal file system. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, then access the USB drive's symlink directory mounted on the NAS to obtain all files within the NAS system and tamper with those files.