This NAS is by all accounts vulnerable in code to this: CVE-2025-30247 — this is the one that matters. OS command injection in the web UI via a crafted HTTP POST, remote, fixed in 5.31.108 (WDC-25006, Sept 2025, credited to w1th0ut). Do you know how many times this has been pwn3d? zero. but if: someone compromised a user device they might be able to pivot.... or they might be able to 0-day the VPN..... they just then need to be: > in the right network >not get detected > find the device > exploit the deice > find something useful on it (good luck with that) but sure 'attackers only need to be right once' /s
Post summary
The message discloses CVE‑2025‑30247 as a remote OS command injection flaw in a NAS web UI, notes no reported exploit activity, and indicates a vendor patch in version 5.31.108.