PT-2026-5972 · Zspace · Q2C Firmware

Published 2026-02-03 · Updated 2026-02-11 · CVE-2025-69431

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZSPACE Q2C NAS (affected versions not specified)

Description The ZSPACE Q2C NAS is affected by an issue involving incorrect symbolic link handling. An attacker can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device, and then access the drive’s directory via the Samba protocol. This allows unauthorized access to and modification of all files within the NAS system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-69431

Affected Products

Q2C Firmware

References · 4

• 🔥 https://notion.so/ZSPACE-Incorrect-Symlink-Follow-2c26cf4e528a8087ba14d9b1d31a5bb2?source=copy_link · Exploit
• https://osv.dev/vulnerability/CVE-2025-69431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69431 · Security Note
• https://t.me/cveNotify/151708 · Telegram Post