Q2c Nas Firmware
Monthly
OS command injection in ZSPACE Q2C NAS firmware up to version 1.1.0210050 lets an authenticated attacker execute arbitrary shell commands on the device by sending a crafted HTTP POST to /v2/file/safe/open with malicious metacharacters in the safe_dir argument, which is processed by zfilev2_api.OpenSafe. The vendor was notified early, confirmed the flaw, and is preparing a technical fix, but as of this analysis no patched firmware has been released. Exploitation requires valid low-privilege credentials (CVSS PR:L) and network access to the NAS management interface, yet the barrier is low because a public proof-of-concept/exploit is already available and EPSS sits at 0.39% (60th percentile); there is currently no indication of confirmed active exploitation in CISA KEV.
Remote command injection in the ZSPACE Q2C NAS firmware through version 1.1.0210050 lets an attacker execute arbitrary OS commands against the appliance by sending a crafted HTTP POST to /v2/file/safe/status with a malicious safe_dir parameter processed by zfilev2_api.SafeStatus. The CVSS v4.0 vector (PR:L, AT:N, UI:N) indicates the attacker must hold valid low-privilege credentials on the NAS web interface but needs no user interaction and no special configuration, and successful exploitation yields high confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (self-reported and corroborated by the exploit reference on Notion) and EPSS is 0.81% (74th percentile), but there is no evidence of confirmed active exploitation (not in CISA KEV); the vendor has acknowledged the flaw and stated a technical fix is planned but not yet released, so all instances up to 1.1.0210050 remain unpatched.
Authenticated command injection in the ZSPACE Q2C NAS web interface (firmware through 1.1.0210050) lets a low-privilege logged-in user execute arbitrary operating-system commands on the device with a single crafted HTTP POST to /v2/file/safe/close, in which the safe_dir argument is passed unsanitized into a shell command inside zfilev2_api.CloseSafe. Because the injected commands run with the privileges of the NAS service, successful exploitation yields full compromise of confidentiality, integrity and availability of the appliance (CVSS 4.0 base 7.4; independent assessment aligns at CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high C/I/A), and publicly available exploit code exists, so the attack is realistic for anyone who already holds any valid account. EPSS is only 0.60% (69th percentile) and the CVE is not in CISA KEV - consistent with a niche NAS model rather than a mass-exploitation event - but the attacker must only be able to reach the management interface over the network, and no vendor patch is available yet (a technical fix is planned), so exposed units remain exploitable today.
OS command injection in ZSPACE Q2C NAS firmware up to version 1.1.0210050 lets an authenticated attacker execute arbitrary shell commands on the device by sending a crafted HTTP POST to /v2/file/safe/open with malicious metacharacters in the safe_dir argument, which is processed by zfilev2_api.OpenSafe. The vendor was notified early, confirmed the flaw, and is preparing a technical fix, but as of this analysis no patched firmware has been released. Exploitation requires valid low-privilege credentials (CVSS PR:L) and network access to the NAS management interface, yet the barrier is low because a public proof-of-concept/exploit is already available and EPSS sits at 0.39% (60th percentile); there is currently no indication of confirmed active exploitation in CISA KEV.
Remote command injection in the ZSPACE Q2C NAS firmware through version 1.1.0210050 lets an attacker execute arbitrary OS commands against the appliance by sending a crafted HTTP POST to /v2/file/safe/status with a malicious safe_dir parameter processed by zfilev2_api.SafeStatus. The CVSS v4.0 vector (PR:L, AT:N, UI:N) indicates the attacker must hold valid low-privilege credentials on the NAS web interface but needs no user interaction and no special configuration, and successful exploitation yields high confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (self-reported and corroborated by the exploit reference on Notion) and EPSS is 0.81% (74th percentile), but there is no evidence of confirmed active exploitation (not in CISA KEV); the vendor has acknowledged the flaw and stated a technical fix is planned but not yet released, so all instances up to 1.1.0210050 remain unpatched.
Authenticated command injection in the ZSPACE Q2C NAS web interface (firmware through 1.1.0210050) lets a low-privilege logged-in user execute arbitrary operating-system commands on the device with a single crafted HTTP POST to /v2/file/safe/close, in which the safe_dir argument is passed unsanitized into a shell command inside zfilev2_api.CloseSafe. Because the injected commands run with the privileges of the NAS service, successful exploitation yields full compromise of confidentiality, integrity and availability of the appliance (CVSS 4.0 base 7.4; independent assessment aligns at CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high C/I/A), and publicly available exploit code exists, so the attack is realistic for anyone who already holds any valid account. EPSS is only 0.60% (69th percentile) and the CVE is not in CISA KEV - consistent with a niche NAS model rather than a mass-exploitation event - but the attacker must only be able to reach the management interface over the network, and no vendor patch is available yet (a technical fix is planned), so exposed units remain exploitable today.