CVE-2025-15131
Published: 28 December 2025
Description
A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has…
more
been made public and could be used. The vendor was contacted early about this disclosure.
Mitigating Controls (NIST 800-53 r5)AI
Validates and sanitizes HTTP POST request inputs to the zfilev2_api_SafeStatus endpoint, directly preventing command injection exploitation.
Mandates timely remediation of the specific command injection flaw in ZSPACE Z4Pro+ version 1.0.0440024 via patching or workarounds.
Enforces least privilege on the HTTP POST Request Handler process, limiting the scope and impact of any successful command injection by low-privilege (PR:L) attackers.
Security SummaryAI
CVE-2025-15131 is a command injection vulnerability affecting ZSPACE Z4Pro+ version 1.0.0440024. The issue resides in the zfilev2_api_SafeStatus function within the /v2/file/safe/status endpoint of the HTTP POST Request Handler component. Published on 2025-12-28, it is associated with CWEs-74 and CWE-77 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), rated as medium severity.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, allowing command injection via manipulated HTTP POST requests to the affected endpoint.
Advisories from VulDB (ctiid.338509, id.338509, submit.713874) and a GitHub issue (LX-66-LX/cve/issues/1) document the vulnerability, noting that the vendor was contacted early about the disclosure. No specific patch or mitigation details are outlined in the available information.
The exploit has been made public and could be used by attackers, increasing the risk for unpatched ZSPACE Z4Pro+ deployments.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in HTTP POST endpoint of web service directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary command execution via T1059 (Command and Scripting Interpreter).