A critical command injection vulnerability in the UGREEN DH2100+ NAS device allows for remote code execution, posing a significant risk of full system compromise.

This vulnerability is a command injection (CWE-77) flaw located in the handler_file_backup_create function of the nas_svr component. The vulnerability is triggered by manipulating the path argument in the /v1/file/backup/create endpoint, requiring high-level administrative privileges for exploitation.

Successful exploitation of this command injection vulnerability allows an attacker to execute arbitrary commands on the affected NAS device with high privileges. This could lead to a complete loss of confidentiality, integrity, and availability of data stored on the device. With a CVSS score of 7.2, this vulnerability represents a high-severity risk that could facilitate lateral movement within the network or unauthorized access to sensitive file backups.

Immediate Action: Contact UGREEN support or monitor the official vendor portal for the release of a security patch addressing this command injection flaw.

Proactive Monitoring: Review system access logs for the /v1/file/backup/create endpoint, specifically looking for unusual characters or command strings within the path argument.

Compensating Controls: Restrict access to the NAS management interface to trusted administrative IP addresses and deploy a Web Application Firewall (WAF) to inspect and block malicious input targeting the backup creation endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Given the availability of a public proof-of-concept, organizations utilizing UGREEN DH2100+ devices must prioritize this vulnerability. Until a vendor-supplied patch is applied, administrators should restrict network access to the device and implement strict input validation at the network perimeter to mitigate the risk of unauthorized remote command execution.