Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or prior to V1.9.12), DM3 (version equal to or prior to V1.9.12), and DM200 (version equal to or prior to V1.2.23) that could be exploited by attackers to leak or tamper with the internal file system. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, then access the USB drive's symlink directory mounted on the NAS to obtain all files within the NAS system and tamper with those files.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 6 products
CVE-2025-69430 An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or prior to V1.9.12), DM3 (version equal to or p… https://www.cve.org/CVERecord?id=CVE-2025-69430
Post summary
An Incorrect Symlink Follow vulnerability (CVE‑2025‑69430) has been disclosed for Yottamaster NAS devices, but no PoC, exploit, or patch information is provided.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | yottamaster | dm2 | - | - | - |
| HW | yottamaster | dm200 | - | - | - |
| OS | yottamaster | dm200_firmware | - | - | - |
| OS | yottamaster | dm2_firmware | - | - | - |
| HW | yottamaster | dm3 | - | - | - |
| OS | yottamaster | dm3_firmware | - | - | - |