ZSPACE Q2C NAS EUVD-2025-201503

Requires a low-privilege authenticated account (PR:L) on the ZSPACE Q2C NAS web interface and network reachability to the device's HTTP service. The attacker sends a POST request to /v2/file/safe/status manipulating the safe_dir argument handled by zfilev2_api.SafeStatus. No user interaction and no special non-default configuration are indicated (AC:L/AT:N/UI:N) - the vulnerable endpoint appears to be part of standard file-safe functionality. The primary limiting factors are the need for valid low-privilege credentials and network access to the appliance; exposure is worsened because no fixed firmware has been released (fix only planned), so all instances up to 1.1.0210050 remain unpatched. Affected: ZSPACE Q2C NAS firmware version 1.1.0210050 and earlier.

This is a command injection (CWE-74) in the ZSPACE Q2C NAS firmware reachable over the network. The VulDB CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates low-complexity remote exploitation requiring low-privilege authentication (PR:L), with full confidentiality, integrity and availability impact - consistent with unsanitized shell command execution on the appliance. The E:P (proof-of-concept) exploit maturity aligns with the reported public exploit. EPSS is 0.81% (74th percentile), which is modest in absolute probability but higher than most of this vendor's other advisories, reflecting that working exploit code has been released. There is NO CISA KEV listing, so despite public POC availability there is no confirmed evidence of active in-the-wild exploitation - POC availability and active exploitation are distinct signals and should not be conflated. A key risk amplifier: the vendor confirmed the flaw but the fix is only PLANNED, not released, creating an open patch gap for any deployed device. The base score of 7.4 (High) is somewhat suppressed by PR:L; if the underlying authentication is weak or the low-privilege tier is easy to obtain, real-world severity approaches critical. All CVSS/description signals are internally consistent (network vector matches the HTTP POST handler description); the main limitation is that all metadata originates from a single low-tier source (VulDB), so version and technical detail confidence is limited.

An attacker with a low-privilege account on the NAS web interface sends a crafted HTTP POST request to /v2/file/safe/status with shell metacharacters embedded in the safe_dir parameter, which is passed unsanitized into a system command by zfilev2_api.SafeStatus, yielding arbitrary command execution on the appliance. A public proof-of-concept exploit has been released (hosted on Notion via the VulDB reference), lowering the barrier to exploitation. Because AC:L and no user interaction are required, exploitation is straightforward once network access and low-privilege credentials are obtained.