EUVD-2025-201501Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege NAS credentials
-
DeliverySend crafted POST to /v2/file/safe/open
-
ExploitInject shell metacharacters via safe_dir
-
ExecutionOpenSafe passes to OS command
-
ImpactExecute arbitrary commands on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Requires low-privilege authenticated access to the ZSPACE Q2C NAS HTTP management interface (CVSS PR:L), then a single crafted POST request to /v2/file/safe/open with malicious shell metacharacters in the safe_dir argument reaching the zfilev2_api.OpenSafe function. Limiting factors: valid credentials are required (not unauthenticated), and the affected product is firmware version up to 1.1.0210050; no vendor patch is available yet, so exposure persists, but the obscure product footprint and credential requirement narrow realistic exploitation to attackers who can reach and authenticate to the device. |
| Impact | This is a genuine remote code execution primitive (OS command injection, CWE-74/78) but its real-world priority is tempered by several signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) shows network reachability, low complexity, and no user interaction, with full CIA impact - but PR:L confirms authentication is required, so an attacker needs valid low-privilege credentials to the NAS management interface. EPSS is low at 0.39% (60th percentile), indicating no evidence of broad automated exploitation despite a public POC. The vector carries E:P (exploit proof-of-concept), consistent with the referenced public POC, but this is distinct from active exploitation: not in CISA KEV, so status is 'publicly available exploit code exists' rather than confirmed in-the-wild use. A key aggravating factor is the patch gap - the vendor confirmed the flaw but states a fix is only PLANNED, not yet released, so no remediation exists as of analysis. Net: a real, credible RCE issue but authentication-gated on an obscure product, making it a targeted rather than widespread threat. |
| Exploit ScenarioDerived | An attacker with (or who has phished/brute-forced) low-privilege credentials to a ZSPACE Q2C NAS sends a crafted HTTP POST to /v2/file/safe/open with shell metacharacters in the safe_dir argument, which zfilev2_api.OpenSafe passes to an OS command unsanitized, yielding arbitrary command execution on the device. A public POC (hosted on Notion, referenced by VulDB) exists and lowers the effort required; the CVSS AV:N/AC:L profile means the request is simple and network-deliverable once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
OS command injection in ZSPACE Q2C NAS firmware up to version 1.1.0210050 lets an authenticated attacker execute arbitrary shell commands on the device by sending a crafted HTTP POST to /v2/file/safe/open with malicious metacharacters in the safe_dir argument, which is processed by zfilev2_api.OpenSafe. The vendor was notified early, confirmed the flaw, and is preparing a technical fix, but as of this analysis no patched firmware has been released. Exploitation requires valid low-privilege credentials (CVSS PR:L) and network access to the NAS management interface, yet the barrier is low because a public proof-of-concept/exploit is already available and EPSS sits at 0.39% (60th percentile); there is currently no indication of confirmed active exploitation in CISA KEV.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch identified at time of analysis: ZSPACE confirmed the vulnerability and has stated that a technical fix is planned, but no fixed firmware version number has been published, so administrators should track the vendor's advisories and the VulDB/NVD references (https://vuldb.com/?id.334490, https://nvd.nist.gov/vuln/detail/CVE-2025-14108) for the eventual release and apply it as soon as it is available. Until then, compensating controls should focus on shrinking the attack surface of the management interface: place the NAS web UI on a dedicated management VLAN or VPN and block ports 80/443 from untrusted networks, which prevents remote reachability (AV:N) but adds operational friction for legitimate remote administration; enforce strong, non-default credentials and rotate them, since exploitation requires low-privilege authentication and any credential leak or shared account materially raises risk; and, at a reverse proxy or WAF in front of the device, reject or normalize POST requests to /v2/file/safe/open whose safe_dir parameter contains shell metacharacters (;, |, &, $, backtick, newline) or path traversal sequences. Blocking the endpoint outright is the strongest mitigation but will disable the file 'safe open' feature for legitimate users, so it should be scoped to non-administrative roles or to deployments where the functionality is unused. Because public exploit code is already available, monitoring for suspicious child processes spawned by the management service and reviewing logs for POST requests to /v2/file/safe/open is recommended to detect attempted or successful exploitation, and the appliance should be assumed compromised if such requests succeeded, warranting credential rotation and a firmware reflash.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an injection flaw (CWE-74, improper neutralization of special elements used by a downstream component, effectively OS command injection / CWE-78) in the JSON-style HTTP API of the ZSPACE Q2C NAS web management service. The endpoint POST /v2/file/safe/open is handled by the zfilev2_api.OpenSafe function, which takes the user-supplied safe_dir parameter and passes it into a shell context without adequate sanitization or parameterization, so characters such as semicolons, pipes, backticks, or command substitution sequences are interpreted by the underlying operating system rather than treated as literal path data. Because the injection point sits in the file-management subsystem of a network-attached storage appliance, successful exploitation typically yields code execution in the context of the NAS management service, and by extension access to stored data and the device's operating environment. The CPE cpe:2.3:o:zspace:q2c_nas_firmware:*:*:*:*:*:*:*:* confirms this is firmware-level software rather than a discrete application, and EUVD records the affected release as Q2C NAS 1.1.0210050 (build suffix 1.1.0210050), matching the upstream disclosure. The CVSS v4.0 vector in the source data (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) agree that exploitation is network-reachable, low complexity, requires low-privilege authentication, and results in high confidentiality, integrity, and availability impact.
Know when Q2c Nas Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remote HTTP endpoint (AV:N), simple crafted request (AC:L), requires low-priv authentication per PR:L, command injection yields full RCE so C/I/A all High on the same system (S:U).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safe_dir causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
Executive ViewAI
ZSPACE Q2C NAS systems running version 1.1.0210050 and earlier are vulnerable to remote command injection through a publicly disclosed exploit with no available patch. Organizations using this storage solution face immediate risk of unauthorized system compromise, data theft, and operational disruption until the vendor releases a fix.
Implement Web Application Firewall (WAF) rules to block POST requests to /v2/file/safe/open endpoint containing suspicious characters (backticks, pipes, semicolons, command substitution syntax); enforce network segmentation isolating NAS systems from production networks; restrict API access via IP allowlisting; disable the safe_dir functionality if operationally permissible; implement intrusion detection/prevention (IDS/IPS) signatures for command injection patterns; require VPN authentication for all remote access to management interfaces; increase audit logging for file operations and API calls on affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Q2c Nas Firmware
View allRemote command injection in the ZSPACE Q2C NAS firmware through version 1.1.0210050 lets an attacker execute arbitrary O
Authenticated command injection in the ZSPACE Q2C NAS web interface (firmware through 1.1.0210050) lets a low-privilege
GitHub PoC
Exploit-DB