CVE-2025-14693 HIGH

CVE-2025-14693: Ugreen DH2100+ USB symlink

Vendor Ugreen
Product DH2100+
Weakness CWE-61
Published December 15, 2025
Last update January 28, 2026
View on NVD All CVEs

CVSS base score

7.0/10
Attack vector Physical
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulation leads to symlink following. The attack can be executed directly on the physical device. The exploit has been disclosed to the public and may be used. It is suggested to upgrade the affected component.

Key dates

02Disclosure timeline

December 15, 2025 CVE published
January 28, 2026 Record updated