Z4Pro Firmware
CVE-2025-15131
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
AnalysisAI
Public command injection in ZSPACE Z4Pro+ firmware allows authenticated remote attackers to execute arbitrary commands via the zfilev2_api_SafeStatus function in the /v2/file/safe/status endpoint. Low CVSS base score (2.1) and EPSS (0.38%) reflect limited impact and low exploitation probability, but public POC code exists, increasing risk for targeted attacks. No evidence of active exploitation in the wild.
More in Z4Pro Firmware
View allWe need to produce a JSON object with the specified fields. The input provides CVE-2025-15133 details: ZSPACE Z4Pro+ fir
Command injection in ZSPACE Z4Pro+ 1.0.0440024 via the /v2/file/safe/open HTTP POST endpoint allows authenticated remote
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today