PT-2025-49316 · Unknown · Zspace Q2C Nas

Renguangyue · Publicado 2025-12-05 · Atualizado 2025-12-16 · CVE-2025-14106

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZSPACE Q2C NAS versions up to 1.1.0210050

Description A command injection issue exists in ZSPACE Q2C NAS. The issue is related to the manipulation of the safe dir argument within the zfilev2 api.CloseSafe function, located in the /v2/file/safe/close file of the HTTP POST Request Handler component. This allows for remote execution of commands. The exploit is publicly available.

Recommendations Versions prior to 1.1.0210050 should be updated. As a temporary workaround, consider restricting access to the /v2/file/safe/close endpoint to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2025-14106

Produtos afetados

Zspace Q2C Nas

Referências · 12

• 🔥 https://notion.so/2af6cf4e528a80bab847dcc1fb677590 · Exploit
• https://twitter.com/CveFindCom/status/1997073333871878503 · Publicação no Twitter
• https://t.me/cveNotify/145591 · Publicação no Telegram
• https://vuldb.com/?id.334488 · Nota
• https://osv.dev/vulnerability/CVE-2025-14106 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1997084246381343175 · Publicação no Twitter
• https://vuldb.com/?submit.697141 · Nota
• https://t.me/cveNotify/145907 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1997059575715930425 · Publicação no Twitter
• https://vuldb.com/?ctiid.334488 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14106 · Nota de Segurança
• https://t.me/CVEtracker/38967 · Publicação no Telegram