High · 7.2 CVE-2025-20016 EUVD-2025-2141GHSA-jjh3-5j35-7c2f

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an …

Published Jan 14, 2025 · Updated Jan 14, 2025 · Assigned by jpcert

Vendor: Y'S Product: STEALTHONE D220 Product: STEALTHONE D340 Product: STEALTHONE D440

Description

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command.

Affected products

Vendor	Product	Affected	Fixed
Y'S	STEALTHONE D220	firmware v6.03.02 and earlier	—
Y'S	STEALTHONE D340	firmware v6.03.02 and earlier	—
Y'S	STEALTHONE D440	firmware v7.00.10 and earlier	—

References

https://stealthone.net/product_info/d220-d340%e3%80%8cv6-03-03%e3%80%8d%e5%8f%8a%e3%81%b3d440%e3%80%8cv7-00-11%e3%80%8d%e3%83%95%e3%82%a1%e3%83%bc%e3%83%a0%e3%82%a6%e3%82%a7%e3%82%a2%e3%82%92%e3%83%aa%e3%83%aa%e3%83%bc%e3%82%b9%e8%87%b4/
https://jvn.jp/en/vu/JVNVU99653331/