CVE-2024-49357: high-severity vulnerability in IceWhaleTech ZimaOS
ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 24%
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json`, expose sensitive data like installed applications and system information without requiring any authentication or authorization. This sensitive data leak can be exploited by attackers to gain detailed knowledge about the system setup, installed applications, and other critical information. As of time of publication, no known patched versions are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
IceWhaleTech · ZimaOSRelated CVEs — IceWhaleTech ZimaOS
In the same product, most dangerous first.
CVE-2026-21891CRITICALZimaOS has Authentication Bypass via System-Level UsernameEPSS 2.3%CVE-2024-49359HIGHZimaOS vulnerable to Directory Listing via Parameter ManipulationEPSS 1.0%CVE-2024-48931HIGHZimaOS Arbitrary File Read via Parameter ManipulationEPSS 0.7%CVE-2024-48932MEDIUMZimaOS Unauthenticated API Discloses UsernamesEPSS 0.5%CVE-2024-49358MEDIUMZimaOS vulnerable to Username Enumeration via API ResponsesEPSS 0.5%CVE-2026-28286HIGHZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via APIEPSS 0.5%