CVE-2025-14107highCWE-74CWE-77

CVE-2025-14107: falha de alta gravidade em ZSPACE Q2C NAS

ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Q2C NAS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

26Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 12%
A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safe_dir results in command injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
ZSPACE · Q2C NAS
CVEs relacionadas — ZSPACE Q2C NAS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-14106HIGHZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injectionEPSS 12.1%CVE-2025-14108HIGHZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injectionEPSS 10.5%