Executive brief
Zettlab D6 Ultra is a network-attached storage (NAS) device with integrated Docker support. A vulnerability in its container volume handling allows attackers to escape the intended directory restrictions by using path traversal sequences ("../" patterns), potentially exposing sensitive system files like /etc/passwd and /etc/shadow. This could enable attackers to gain unauthorized access to the NAS and escalate privileges to root level.
Technical details
This is a path traversal vulnerability (CWE-22) in the container volume mounting logic of Zettlab D6 Ultra before version 1.7.0. The vulnerability allows an attacker to specify compose files with malicious volume paths containing ".." sequences (e.g., "../../../../../../../etc:/h_etc:rw") to mount arbitrary host directories, including sensitive system configuration files, into containers. The attack requires the ability to deploy or modify Docker Compose files on the device—likely through the web UI. An authenticated user with container deployment permissions can exploit this to read sensitive files like /etc/passwd and /etc/shadow, which can facilitate further privilege escalation attacks. The vulnerability is fixed in version 1.7.0.
Affected products
- Zettlab D6 Ultra before 1.7.0
Timeline
- 2026-02-27: disclosed
- 2026-03: patched: Fix expected in 1.7.0 firmware update