PT-2026-22627 · Casaos+1 · Casaos+1

Publicado 2026-03-02 · Atualizado 2026-03-06 · CVE-2025-64427

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions ZimaOS versions prior to 1.5.1

Description ZimaOS, a fork of CasaOS, is susceptible to a flaw stemming from inadequate validation or restriction of target URLs. An authenticated local user can construct requests that target internal IP addresses, such as 127.0.0.1, localhost, or private network ranges. This enables interaction with internal HTTP/HTTPS services not intended for external or local user access.

Recommendations Update ZimaOS to version 1.5.1 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

SSRF

Enumeração de Fraquezas

CWE-200

CWE-918

Identificadores relacionados

CVE-2025-64427

GHSA-M8HJ-7XG5-P375

Produtos afetados

Casaos

Zimaos

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64427.json · Exploit
• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-m8hj-7xg5-p375 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2028650273300758899 · Publicação no Twitter
• https://t.me/cveNotify/154338 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-64427 · Aviso do Fabricante
• https://t.me/CVEtracker/46128 · Publicação no Telegram
• https://twitter.com/cracbot/status/2029512417160658985 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-64427 · Nota de Segurança
• https://twitter.com/cracbot/status/2029874879013806348 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2028523508188242121 · Publicação no Twitter