CVE-2025-14224 is a medium severity (CVSS 4.3) path traversal in the File Upload feature of Yottamaster DM2, DM3 and DM200 devices, up to firmware 1.2.23 and 1.9.12. The record names no fix and says the vendor did not respond, so keep the devices off the internet and check for new firmware.
What's affected
- Products: Yottamaster DM2, DM3 and DM200 and their firmware.
- Affected versions: the record says up to 1.2.23 and 1.9.12 and does not map each number to a model. Treat any firmware at or below those numbers as affected until the vendor says otherwise.
- Component: File Upload.
- Fixed version: none is named. The vendor was contacted early and did not respond, per the description.
- Weakness: CWE-22 (path traversal). See the Gold page for CVE-2025-14224.
- Severity: Medium, CVSS 4.3, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. - CISA KEV: not listed.
How to check if you're exposed
Read the firmware version in the device's management page or companion app and compare it with the numbers above. If you cannot tell which number applies to your model, assume affected.
Then check network exposure. Network attached storage and similar devices are sometimes opened to the internet for remote access. Check your router for port forwards pointing at the device, and check any vendor cloud access feature you enabled.
Record every unit with its model, firmware and location. These devices tend to sit unmanaged under a desk, so an inventory walk is often the only way to find them.
What to do now
- Identify all Yottamaster DM2, DM3 and DM200 devices and their firmware versions.
- Remove port forwards and disable remote access features that expose the file service to the internet.
- Keep the devices on a trusted network segment and limit who can upload to them.
- Check the vendor's site for new firmware, and apply it if one appears. The record does not confirm a fix.
- Keep backups of important data somewhere that is not writable from the same network path.
- Replace the device if the vendor stays silent and it must stay reachable.
Why it matters
Path traversal means a file path supplied by a user is not constrained to the folder the application intended. Using sequences that move up the directory tree, a request can end up reading or writing outside the intended area. For an upload feature, the worry is that a file lands somewhere it should not.
The record scores this as medium. The vector shows a low privilege requirement and a low integrity impact, with no confidentiality or availability impact, which fits a write limited by what the device allows. It is not marked exploited and is not in CISA KEV, but the record says the exploit details were made public. The lack of any vendor response is the main reason to rely on network controls.
Quick check
Which firmware fixes CVE-2025-14224?
The record names no fixed version. Check the vendor's download page and keep the device off untrusted networks meanwhile.
Is this exploited in the wild?
The record does not say so and it is not in CISA KEV. It does say the exploit has been made public.
Sources
- NVD record data for CVE-2025-14224 (Safeguard Gold entry)
Last reviewed: 19 October 2026.
