Incorrect Symlink Follow Vulnerability in ORICO NAS CD3510
CVE-2025-69429

6.1MEDIUM

Key Information:

Vendor

ORICO

Status
NAS CD3510
Vendor
CVE Published:
3 February 2026

What is CVE-2025-69429?

The ORICO NAS CD3510, specifically version V1.9.12 and earlier, is affected by an Incorrect Symlink Follow vulnerability. This flaw allows attackers to exploit the internal file system, leading to potential data leakage or unauthorized file tampering. By formatting a USB drive to ext4, creating a symbolic link to its root directory, and inserting it into the NAS device, malicious actors can access and modify all files stored within the NAS system. This vulnerability underscores the importance of securing network-attached storage systems against such exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.notion.so/ORICO-NAS-Incorrect-Symlink-Follow-...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.