EUVD-2025-210899
GHSA-vp95-63jx-qx25
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Adjacent network, low-privilege auth required, read-only confidentiality impact; no integrity or availability impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.
AnalysisAI
Absolute path traversal in the Zettlab D6 Ultra NAS firmware before version 1.7.0 permits authenticated network-adjacent users to navigate outside their designated personal folder and read files from arbitrary directories on the device. The vulnerability stems from insufficient sanitization of user-supplied file paths, allowing the personal-folder boundary to be bypassed using absolute path references. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is confirmed in version 1.7.0.
Technical ContextAI
CWE-36 (Absolute Path Traversal) occurs when an application accepts user-controlled file paths and fails to reject or normalize paths that begin with a filesystem root, allowing callers to reference locations entirely outside the intended working directory. Unlike relative traversal (CWE-22, using '../'), absolute traversal supplies a fully qualified path (e.g., '/etc/passwd') that bypasses directory-prefix checks. The affected product is identified by CPE cpe:2.3:a:zettlab:d6_ultra:*:*:*:*:*:*:*:* - a consumer/prosumer NAS appliance manufactured by Zettlab. The CVSS vector (AV:A) indicates the attack surface is the local network segment, consistent with a NAS device typically reachable only over LAN or VPN. The PR:L metric confirms that at minimum a low-privilege authenticated session is required, ruling out unauthenticated remote exploitation.
RemediationAI
Upgrade Zettlab D6 Ultra firmware to version 1.7.0 or later, which is confirmed by the CVE description as the first patched release. As a compensating control prior to patching, restrict NAS access to trusted LAN segments or VPN-only connections to reduce the pool of potential attackers who can reach the adjacent-network attack surface; this does not eliminate the vulnerability but limits who can exploit it. Auditing shared NAS user accounts and revoking unnecessary low-privilege credentials reduces the PR:L prerequisite. No official vendor advisory URL was available in the provided references to confirm additional mitigation guidance.
Same weakness CWE-36 – Absolute Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today