Z4Pro Firmware CVE-2025-15133

We need to produce a JSON object with the specified fields. The input provides CVE-2025-15133 details: ZSPACE Z4Pro+ firmware 1.0.0440024, command injection in zfilev2_api_CloseSafe, remote, publicly available exploit. EPSS 0.38%, percentile 59%. CWE-74 (improper neutralization). CVSS 4.0 vector given: base score 2.1, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So it's low score despite network vector, low privileges required, but impacts are all low (confidentiality, integrity, availability low). EPSS low, no KEV, but POC available.

Product: ZSPACE Z4Pro+ firmware (the CPE says cpe:2.3:o:zspace:z4pro\+_firmware:1.0.0440024). Product name: ZSPACE Z4Pro+. That's a specific device.

Now synthesize all fields.

product_name: "ZSPACE Z4Pro+" (the firmware is part of the product). So just "ZSPACE Z4Pro+".

summary: Must not copy description. Need to weave in the fact that it's command injection, remote, authenticated (PR:L), POC available, EPSS low, CVSS low. Write impact: "Authenticated command injection in ZSPACE Z4Pro+ firmware 1.0.0440024 allows remote attackers with low privileges to execute arbitrary commands via a crafted HTTP POST request to /v2/file/safe/close." Mention POC publicly available, not actively exploited. EPSS low, so limited real-world exploitation probability. No KEV.

technical_context: Underlying technology: HTTP POST request handler in firmware, file management API endpoint; command injection in CloseSafe function. CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). Use CPE for product. Explain that command injection occurs when input is not properly sanitized before being passed to a system command.

risk_assessment: Use CVSS 4.0 vector: AV:N (network), AC:L, AT:N (attack requirements none), PR:L (low privileges), UI:N. Impacts VC:L/VI:L/VA:L — confidentiality, integrity, availability all low. So it's a limited impact, maybe command execution but scope unchanged. EPSS 0.38%, percentile 59% meaning low probability of exploitation in next 30 days. No KEV. POC publicly available. So risk is moderate: authenticated low-privilege leads to low impact, EPSS low, but exploit available. SSVC: exploitation none (no active), automatable maybe yes (network, low complexity), technical impact partial. So likely a lower priority. Contrast: CVSS 2.1 is very low, but base metric impacts only low. So the vulnerability is not high severity, but still an authenticated command injection. State that the CVSS score is low due to low impacts, not high impact. POC exists but EPSS suggests not widely targeted. Missing: no confirmation from vendor, only vuldb submission.

affected_products: "ZSPACE Z4Pro+ firmware version 1.0.0440024 (cpe:2.3:o:zspace:z4pro\+_firmware:1.0.0440024). Refer to vendor advisory (not provided in references)." Since no advisory link, just mention vuldb and GitHub issue.

remediation: No patch version specified. The description says vendor was contacted early about disclosure, but no fix. So primary remediation: upgrade firmware when available. Workaround: restrict access to the HTTP management interface, disable /v2/file/safe/close endpoint if possible, or apply input validation. But since no patched version, suggest compensating controls: For example, restrict network access to trusted IPs, require strong authentication, monitor for suspicious requests. State no vendor-released patch identified. Vuldb reference may have details.

exploit_scenario: A remote attacker with low-privilege credentials (e.g., device user) sends a crafted HTTP POST request to the /v2/file/safe/close endpoint, injecting OS commands via unsanitized input. The command executes with the privileges of the web server process, potentially leading to file manipulation, data leakage, or service disruption. POC is publicly available, so exploitation could be automated.

exploitation_conditions: Authenticated (requires low privileges) per CVSS PR:L. The vulnerability is in the zfilev2_api_CloseSafe function handling HTTP POST requests to /v2/file/safe/close. No user interaction needed (UI:N). No special configuration beyond default device? The description says "was identified in ZSPACE Z4Pro+ 1.0.0440024" so likely default configuration. So conditions: network access to the device's HTTP service (likely management interface), possession of low-privilege credentials. So "Low-privilege credentials for the device's HTTP management interface are required; the vulnerable endpoint /v2/file/safe/close is exposed by default."

attack_chain: Phases: network access → send crafted POST request with malicious input to /v2/file/safe/close → command injection in CloseSafe function → execute arbitrary OS command. Could add: "Obtain low-privilege credentials (e.g., via default credentials, brute force, or other vuln)" as a step? But the chain as given: 3-7 steps. Use: "Send crafted HTTP POST request to /v2/file/safe/close → Inject command into vulnerable parameter → Execute OS command with web server privileges". That's 3 steps. But we need to include the requirement of authentication, so maybe "Authenticate to device with low-privilege credentials → Send crafted HTTP POST to /v2/file/safe/close → Inject OS commands via unsanitized input → Execute arbitrary commands". That's 4 steps. Use: "Authenticate with low-privilege credentials → Craft malicious HTTP POST request → Send to /v2/file/safe/close endpoint → Trigger command injection in zfilev2_api_CloseSafe → Execute OS command as web server user". That's 5 steps. Good. No need for persistence, impact is low, so chain: Authenticate → Send crafted POST → Exploit command injection → Execute command. That captures it. Write: "Authenticate to device with low-privilege credentials → Send crafted HTTP POST request to /v2/file/safe/close → Inject OS commands via unsanitized input → Execute arbitrary commands as web server user". That's 4 steps. Arrow separated.

confidence_notes: "Exploit is publicly available via GitHub, but no confirmation of active exploitation. Low EPSS score suggests low real-world exploitation probability. Affected version confirmed by CPE; no vendor advisory found, patch status unknown. Vulnerability reported to vendor but no fix verified." So mention that.

prevalence: Unknown product ZSPACE Z4Pro+, likely a niche device (maybe VR/AR? ZSPACE is a company that makes interactive displays for education, Z4Pro+ might be a 3D display). Probably low prevalence. So "low". Basis: "niche educational hardware with limited enterprise footprint". So prevalence "low", basis: "niche educational hardware, limited deployment".

assessed_cvss_vector: We need to propose our own CVSS 3.1 vector. Base on description: Network attack vector (remote), low attack complexity (no special conditions), privileges required low (PR:L from 4.0 vector), user interaction none, scope unchanged (SC:N in 4.0 implies S:U), impacts: confidentiality low, integrity low, availability low from 4.0's VC:L/VI:L/VA:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That would give base score maybe 6.3? But that's higher than their 4.0 score 2.1. That 4.0 score might be extremely low because of the "E:P" only adding a small temporal? But base score 2.1 seems weird for AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L. CVSS v4.0 calculator: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N yields base score 5.1? Wait, let's check typical CVSS v4.0 scoring: The given string has base metric values but also environmental metrics masked X. The provided vector is exactly as given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... All base metrics are there, so base score is calculated from those. I recall CVSS v4.0 base score for AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N would be something around 5.3? I can't compute exactly without a calculator, but 2.1 seems suspicious. However, the question says CVSS Score: 2.1, and provides that vector. Possibly the low score is because the impacts are all low, but 2.1 seems very low. Maybe I misread: Some CVSS v4.0 base scores for low impact can be as low as 2.0 when combined with certain PR etc. Actually, with PR:L, the impact subscore is based on the low impacts. The CVSS v4.0 base score formula: I don't have it memorized, but I'd expect a score of maybe 5.0. But the given score is 2.1, so maybe they included "E:P" (exploit maturity) in the score, because that's a temporal metric, not base. The provided vector includes temporal score (E:P), so the overall score might incorporate that, lowering it further from a base of maybe 5.1. For our assessed CVSS vectors, we need to provide our own base vector without temporal metrics. The instruction: "Your OWN independent CVSS 3.1 base-metric vector ... NOT a copy of any score in the input." So I'll just assign the base metrics independently. I think AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L is appropriate. That's a valid CVSS:3.1 base score around 6.3. But is that justified? The vulnerability is command injection, which often has high integrity and maybe high confidentiality, but the CVSS 4.0 has low impacts. The description doesn't specify high impact; it's just command injection. So low impact might be understating it. However, to be faithful to the low impacts in the provided vector, I'll keep them low. The CVSS 4.0 vector from the source says VC:L/VI:L/VA:L, so I'll map to C:L/I:L/A:L. That yields a moderate score. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L". For CVSS 4.0: need to map to 4.0 base metrics. I'll produce the same base as the input without temporal: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". That would be a base score around 5.1 maybe. But the input had temporal E:P lowering to 2.1. But I'll output base vector only, no temporal. So good. Rationale: "Requires low-privilege authentication (PR:L), impacts are limited to low confidentiality, integrity, and availability (C:L/I:L/A:L). Network attack vector." For the CVSS 4.0 rationale: one sentence max 25 words: "Network exploitable with low privileges and no user interaction; impacts are all low." that works. Provide both.

assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" (no temporal).

Now assemble JSON. Ensure all fields are plain text strings. So:

product_name: "ZSPACE Z4Pro+" summary: "Authenticated command injection in ZSPACE Z4Pro+ firmware 1.0.0440024 allows remote attackers with low privileges to execute arbitrary OS commands via a crafted HTTP POST request to the /v2/file/safe/close endpoint. A public proof-of-concept exploit is available, but EPSS indicates low exploitation likelihood (0.38%). No active exploitation reported." technical_context: "The flaw resides in the zfilev2_api_CloseSafe function of