Cyber Posture

CVE-2025-15131

MediumPublic PoC

Published: 28 December 2025

Published
28 December 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0043 62.7th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has…

more

been made public and could be used. The vendor was contacted early about this disclosure.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Validates and sanitizes HTTP POST request inputs to the zfilev2_api_SafeStatus endpoint, directly preventing command injection exploitation.

prevent

Mandates timely remediation of the specific command injection flaw in ZSPACE Z4Pro+ version 1.0.0440024 via patching or workarounds.

prevent

Enforces least privilege on the HTTP POST Request Handler process, limiting the scope and impact of any successful command injection by low-privilege (PR:L) attackers.

Security SummaryAI

CVE-2025-15131 is a command injection vulnerability affecting ZSPACE Z4Pro+ version 1.0.0440024. The issue resides in the zfilev2_api_SafeStatus function within the /v2/file/safe/status endpoint of the HTTP POST Request Handler component. Published on 2025-12-28, it is associated with CWEs-74 and CWE-77 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), rated as medium severity.

Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, allowing command injection via manipulated HTTP POST requests to the affected endpoint.

Advisories from VulDB (ctiid.338509, id.338509, submit.713874) and a GitHub issue (LX-66-LX/cve/issues/1) document the vulnerability, noting that the vendor was contacted early about the disclosure. No specific patch or mitigation details are outlined in the available information.

The exploit has been made public and could be used by attackers, increasing the risk for unpatched ZSPACE Z4Pro+ deployments.

Details

CWE(s)

Affected Products

zspace
z4pro\+ firmware
≤ 1.0.0440024

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Command injection vulnerability in HTTP POST endpoint of web service directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary command execution via T1059 (Command and Scripting Interpreter).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References