Cyber Posture

CVE-2025-14106

HighPublic PoC

Published: 05 December 2025

Published
05 December 2025
Modified
16 December 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0126 79.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is…

more

possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Requires validation of the safe_dir parameter in HTTP POST requests to the /v2/file/safe/close endpoint, directly preventing command injection exploitation.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the command injection flaw in the zfilev2_api.CloseSafe function via vendor patches, eliminating the vulnerability.

AC-6 Least Privilege partial match
prevent

Enforces least privilege for low-privilege authenticated users (PR:L), limiting the scope and impact of arbitrary command execution on the NAS device.

Security SummaryAI

CVE-2025-14106 is a command injection vulnerability in ZSPACE Q2C NAS versions up to 1.1.0210050. The issue affects the zfilev2_api.CloseSafe function, exposed via the /v2/file/safe/close endpoint in the HTTP POST Request Handler component. By manipulating the safe_dir argument, an attacker can inject arbitrary commands, as classified under CWE-74 (injection) and CWE-77 (command injection specifically). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability enables remote exploitation by authenticated users with low privileges (PR:L). Attackers can send a crafted HTTP POST request to the affected endpoint, injecting commands through the safe_dir parameter to execute arbitrary system commands on the NAS device. Successful exploitation grants high-level confidentiality, integrity, and availability impacts, potentially allowing full compromise of the device, data exfiltration, or further lateral movement.

Advisories from VulDB indicate that the vendor was notified early, confirmed the vulnerability's existence, and plans to release a technical fix, though no patch details or timeline are specified. An exploit is publicly available and may already be in use. Security practitioners should monitor for updates from the vendor and restrict access to the /v2/file/safe/close endpoint where possible.

Notable context includes the public availability of the exploit, increasing the risk of active exploitation against unpatched ZSPACE Q2C NAS deployments.

Details

CWE(s)
CWE-74CWE-77

Affected Products

zspace
q2c nas firmware
≤ 1.1.0210050

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Command injection via public-facing HTTP endpoint (T1190, T1210) enables arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References