UGREEN DH2100+ Buffer Overflow Vulnerability in NAS Service

A buffer overflow vulnerability has been identified in the UGREEN DH2100+ NAS device, affecting firmware versions prior to 5.3.0.251125. The vulnerability arises in the 'handler_file_backup_create' function within the '/v1/file/backup/create' endpoint of the 'nas_svr' component. By manipulating the 'path' argument, an attacker can exploit this vulnerability remotely. The issue has been publicly disclosed, and an exploit is available.

Impact

Exploitation of this vulnerability can lead to a buffer overflow, allowing for arbitrary code execution on the affected NAS device. Additionally, the 'nas_svr' service can be crashed, causing a denial-of-service condition.