A remote buffer overflow vulnerability in UGREEN DH2100+ devices poses a significant risk of system compromise and potential code execution.

The flaw is a buffer overflow (CWE-120) located in the handler_file_backup_create function within the /v1/file/backup/create endpoint of the nas_svr component. While the CVSS vector indicates that high privileges are required for exploitation, the vulnerability is remotely accessible and can result in total system impact.

Successful exploitation of this buffer overflow can lead to a complete compromise of the NAS device, resulting in unauthorized access to sensitive stored data and potential service disruption. With a CVSS score of 7.2, this vulnerability represents a high-severity risk to business continuity and data confidentiality, particularly for organizations relying on these devices for centralized file storage.

Immediate Action: Contact UGREEN support or monitor official security channels for the release of a firmware update that addresses the vulnerability in the nas_svr component.

Proactive Monitoring: Review device access logs for unusual activity targeting the /v1/file/backup/create endpoint or attempts to inject malformed path arguments.

Compensating Controls: Restrict management interface access to trusted administrative IP addresses via firewall rules to prevent unauthorized remote access to the vulnerable endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the referenced technical write-up.

The presence of a published proof-of-concept for this buffer overflow significantly elevates the risk of exploitation. Administrators should prioritize restricting network access to the affected NAS devices immediately and remain vigilant for vendor-supplied firmware patches to permanently remediate the underlying memory corruption flaw.