EUVD-2025-201502Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege NAS credentials
-
DeliverySend POST /v2/file/safe/close with malicious safe_dir
-
ExploitBreak out via shell metacharacters in CloseSafe
-
ExecutionExecute injected OS commands
-
ImpactFull device compromise (data theft/persistence)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Requires low-privilege authenticated access to the NAS web interface (CVSS PR:L), then a single crafted HTTP POST to /v2/file/safe/close with a malicious safe_dir parameter routed to zfilev2_api.CloseSafe - no user interaction and no special non-default configuration is indicated. Limiting factors: the attacker must already hold valid (even low-privilege) credentials or defeat authentication separately, and the device must be network-reachable; the extremely small deployment base of the ZSPACE Q2C NAS further constrains realistic targeting. No vendor patch is available yet (fix only planned), so exposed devices cannot currently be remediated by upgrade. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) describes a remotely reachable, low-complexity command injection requiring only low-privilege authentication (PR:L) and no user interaction, yielding full high impact to confidentiality, integrity and availability of the NAS - effectively device RCE. Exploitation signals are mixed-to-moderate: a POC is publicly available (VulDB notion link, E:P 'Proof-of-Concept' in the vector), but EPSS is only 0.60% (69th percentile), there is NO CISA KEV listing, and no evidence of active exploitation. This is a genuinely serious technical flaw (authenticated command injection → RCE) but its real-world priority is tempered by the obscure product footprint and the fact that the vendor has only PLANNED a fix - no patch is released yet, creating a patch gap. Note a limitation signal: the vendor 'confirmed the existence of the vulnerability' but the fix is unreleased, so exposed devices remain unmitigated. Overall: real and RCE-capable, but likely targeted/opportunistic rather than mass-exploited given the niche NAS platform and modest EPSS. |
| Exploit ScenarioDerived | An attacker with low-privilege credentials on a ZSPACE Q2C NAS (or who obtains them via weak/default logins) sends a crafted HTTP POST to /v2/file/safe/close with a malicious safe_dir argument containing shell metacharacters, which zfilev2_api.CloseSafe passes unsanitized to an OS command, executing attacker commands as the NAS service account. A public POC exists (VulDB), lowering the skill barrier; low complexity and network reachability make this straightforward against exposed or LAN-accessible devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
Authenticated command injection in the ZSPACE Q2C NAS web interface (firmware through 1.1.0210050) lets a low-privilege logged-in user execute arbitrary operating-system commands on the device with a single crafted HTTP POST to /v2/file/safe/close, in which the safe_dir argument is passed unsanitized into a shell command inside zfilev2_api.CloseSafe. Because the injected commands run with the privileges of the NAS service, successful exploitation yields full compromise of confidentiality, integrity and availability of the appliance (CVSS 4.0 base 7.4; independent assessment aligns at CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high C/I/A), and publicly available exploit code exists, so the attack is realistic for anyone who already holds any valid account. EPSS is only 0.60% (69th percentile) and the CVE is not in CISA KEV - consistent with a niche NAS model rather than a mass-exploitation event - but the attacker must only be able to reach the management interface over the network, and no vendor patch is available yet (a technical fix is planned), so exposed units remain exploitable today.
Earlier versions of this analysis (1)
RemediationAI
There is currently no vendor-released patch for CVE-2025-14106 - the disclosure states only that a technical fix is planned after ZSPACE confirmed the flaw - so 'upgrade to the fixed version' is not yet an available action; register with ZSPACE support or monitor the VulDB/NVD entries (https://vuldb.com/?id.334488, https://nvd.nist.gov/vuln/detail/CVE-2025-14106) for the firmware release and apply it as soon as it ships. Until then, the highest-value compensating control is to remove the attack surface: do not expose the Q2C NAS web management interface (/v2 API) to the internet or to broad LAN segments - bind it to a dedicated management VLAN or reach it only through a VPN/SSH tunnel, accepting the operational inconvenience that remote file-management and admin tasks must go through that jump path. Because exploitation requires a valid low-privilege login and the vulnerable handler is a privileged, path-manipulating file operation, audit all Q2C accounts, delete or disable unused ones, enforce unique strong passwords and lockouts, and avoid shared read-only accounts that would otherwise satisfy PR:L; note this only raises the bar, since any compromised credential (or a separate auth bypass) re-enables the flaw. Where an inline reverse proxy or WAF can be placed in front of the appliance, reject POST requests to /v2/file/safe/close whose safe_dir parameter contains shell metacharacters or traversal sequences, and rate-limit that endpoint - with the caveat that signature-based filtering is bypassable via encoding and must not be treated as a fix. Segment the NAS onto a storage-only network with strict egress filtering so that commands injected into the handler have limited reachable targets, and enable/forward appliance logs to a SIEM, alerting on unexpected child processes or outbound connections from the NAS (a decent, low-cost detection given the 'publicly available exploit code exists' status). Finally, if the device cannot be segmented and is not business-critical, take it off the network until patched; a factory reset does not remove the vulnerability because it resides in the firmware image.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-74 (improper neutralization of special elements in output used by a downstream component), realized here as classic OS command injection. The NAS management stack exposes a JSON/REST-style HTTP API versioned under /v2, and the endpoint /v2/file/safe/close - implemented by the handler function zfilev2_api.CloseSafe - takes a caller-supplied safe_dir parameter that is intended to name a directory on the SATA-attached storage pool. Instead of validating or escaping the value, the firmware concatenates it into an operating-system command executed by the underlying Linux system, so shell metacharacters (;, |, backticks, $(), newline) in safe_dir are interpreted by /bin/sh rather than treated as literal path characters. The vulnerability lives in the Q2C NAS firmware image (CPE cpe:2.3:o:zspace:q2c_nas_firmware:*:*:*:*:*:*:*:*), i.e. in the embedded HTTP request handler itself rather than in a third-party library; EUVD confirms version 1.1.0210050 as affected. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P indicates a network-reachable, low-complexity, no-user-interaction issue that requires low privileges (PR:L) and whose recent exploitation-probability metric is 'proof-of-concept' (E:P), matching the public exploit write-up rather than confirmed active abuse. Impact is confined to the vulnerable system (SC:N/SI:N/SA:N): the injected commands execute as the NAS's own service account, which on a typical Q2C deployment is effectively root-equivalent for the storage and file services it manages.
Know when Nas gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable low-complexity command injection needing low-privilege auth (PR:L) and no interaction, giving OS-level command execution with full C/I/A impact on the device (S:U).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
Executive ViewAI
A critical remote command injection vulnerability exists in ZSPACE Q2C NAS systems (versions up to 1.1.0210050) that allows unauthenticated attackers to execute arbitrary commands. With a publicly available exploit and no vendor patch currently available, any organization using affected NAS appliances faces immediate risk of data breach, system compromise, and operational disruption.
Deploy Web Application Firewall (WAF) rules to block POST requests to /v2/file/safe/close endpoint or sanitize safe_dir parameters for command injection patterns; implement network segmentation to restrict NAS access to authorized systems only; disable the zfilev2_api.CloseSafe function if operationally feasible; enforce strict input validation at network perimeter; enable enhanced logging and alerting on HTTP POST requests to affected endpoints; consider running affected NAS systems on isolated network segment with egress filtering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in Q
Remote command injection in the ZSPACE Q2C NAS firmware through version 1.1.0210050 lets an attacker execute arbitrary O
QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded g
GitHub PoC
Exploit-DB