PT-2025-53647 · Zspace · Zspace Z4Pro+

Lx-66-Lx · Published 2025-12-28 · Updated 2025-12-28 · CVE-2025-15132

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZSPACE Z4Pro+ version 1.0.0440024

Description A flaw exists in ZSPACE Z4Pro+ that allows for command injection. The issue is located within the zfilev2 api open function, accessible through the /v2/file/safe/open endpoint of the HTTP POST Request Handler component. This manipulation can be initiated remotely, and details of the exploit have been publicly disclosed.

Recommendations Apply updates to address the issue in the zfilev2 api open function. As a temporary workaround, consider restricting access to the /v2/file/safe/open API endpoint until a patch is available.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-15132

Affected Products

Zspace Z4Pro+

References · 9

• 🔥 https://github.com/LX-66-LX/cve/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15132 · Security Note
• https://t.me/cveNotify/146971 · Telegram Post
• https://t.me/CVEtracker/40768 · Telegram Post
• https://twitter.com/CVEnew/status/2005230681056858112 · Twitter Post
• https://vuldb.com/?submit.713885 · Note
• https://vuldb.com/?id.338510 · Note
• https://vuldb.com/?ctiid.338510 · Note