PT-2025-49395 · Sgai · Space1 Nas N1211Ds

Renguangyue · Published 2025-12-07 · Updated 2025-12-09 · CVE-2025-14184

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SGAI Space1 NAS N1211DS versions through 1.0.915

Description A command injection issue exists in the gsaiagent component. The RENAME FILE/OPERATE FILE/NGNIX UPLOAD function within the /cgi-bin/JSONAPI file is susceptible to manipulation, leading to command injection. This attack can be initiated remotely. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions through 1.0.915: As a temporary workaround, consider restricting access to the /cgi-bin/JSONAPI file to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-14184

Affected Products

Space1 Nas N1211Ds

References · 11

• 🔥 https://notion.so/2b16cf4e528a80f2ada9dc83651a4013 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14184 · Security Note
• https://vuldb.com/?ctiid.334604 · Note
• https://twitter.com/SecAideInfo/status/1998336475969016142 · Twitter Post
• https://t.me/CVEtracker/39036 · Telegram Post
• https://notion.so/2b16cf4e528a80858abbf62b721a54b0 · Note
• https://vuldb.com/?submit.698570 · Note
• https://vuldb.com/?submit.698568 · Note
• https://vuldb.com/?id.334604 · Note
• https://t.me/cveNotify/145021 · Telegram Post
• https://vuldb.com/?submit.698569 · Note