Cyber Posture

CVE-2025-14107

HighPublic PoC

Published: 05 December 2025

Published
05 December 2025
Modified
16 December 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0170 82.4th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safe_dir results in…

more

command injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by validating the manipulated safe_dir argument in the HTTP POST request to the vulnerable endpoint.

SI-2 Flaw Remediation good match
prevent

Ensures timely identification, reporting, and patching of the command injection flaw in ZSPACE Q2C NAS firmware up to version 1.1.0210050.

SI-4 System Monitoring good match
detect

Enables monitoring for anomalous POST requests to /v2/file/safe/status, identifying exploitation attempts of the command injection vulnerability.

Security SummaryAI

CVE-2025-14107 is a command injection vulnerability affecting ZSPACE Q2C NAS devices running versions up to 1.1.0210050. The flaw resides in the zfilev2_api.SafeStatus function, exposed via the /v2/file/safe/status endpoint in the HTTP POST Request Handler component. By manipulating the safe_dir argument in a POST request, an attacker can inject arbitrary commands, as classified under CWE-74 (injection) and CWE-77 (command injection specifically). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with significant impacts on confidentiality, integrity, and availability.

Attackers with low privileges (PR:L), such as authenticated users, can exploit this remotely over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary command execution on the underlying system, potentially leading to full compromise including data exfiltration, modification, or disruption of NAS services. An exploit has been publicly released, increasing the risk of widespread abuse.

VulDB advisories (e.g., ctiid.334489, id.334489) detail the issue, noting that the vendor was notified early, confirmed the vulnerability, and plans to release a technical fix. No patches are available as of the CVE publication on 2025-12-05, so practitioners should restrict access to the affected endpoint, monitor for anomalous POST requests to /v2/file/safe/status, and prepare for upgrades. Additional details are available in the referenced Notion document.

Details

CWE(s)
CWE-74CWE-77

Affected Products

zspace
q2c nas firmware
≤ 1.1.0210050

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

The remote command injection vulnerability (CWE-77) in the public-facing HTTP POST endpoint (/v2/file/safe/status) enables exploitation of a public-facing application (T1190), execution of Unix shell commands (T1059.004), indirect command execution (T1202 as cited in advisory), and exploitation of remote services for RCE (T1210).

References