Critical · 9.8 CVE-2025-20055 EUVD-2025-2145GHSA-8937-j2m3-x4gq

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can …

Published Jan 14, 2025 · Updated Jan 14, 2025 · Assigned by jpcert

Vendor: Y'S Product: STEALTHONE D220 Product: STEALTHONE D340

Description

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command.

Affected products

Vendor	Product	Affected	Fixed
Y'S	STEALTHONE D220	firmware v6.03.02 and earlier	—
Y'S	STEALTHONE D340	firmware v6.03.02 and earlier	—

References

https://stealthone.net/product_info/d220-d340%e3%80%8cv6-03-03%e3%80%8d%e5%8f%8a%e3%81%b3d440%e3%80%8cv7-00-11%e3%80%8d%e3%83%95%e3%82%a1%e3%83%bc%e3%83%a0%e3%82%a6%e3%82%a7%e3%82%a2%e3%82%92%e3%83%aa%e3%83%aa%e3%83%bc%e3%82%b9%e8%87%b4/
https://jvn.jp/en/vu/JVNVU99653331/