CVE-2025-14106highCWE-74CWE-77

CVE-2025-14106: falha de alta gravidade em ZSPACE Q2C NAS

ZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Q2C NAS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

26Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 12%
A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
ZSPACE · Q2C NAS
CVEs relacionadas — ZSPACE Q2C NAS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-14107HIGHZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injectionEPSS 12.2%CVE-2025-14108HIGHZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injectionEPSS 10.5%