Cyber Posture

CVE-2025-15133

MediumPublic PoC

Published: 28 December 2025

Published
28 December 2025
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0043 62.7th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely.…

more

The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Requires validation of untrusted HTTP POST inputs to the zfilev2_api_CloseSafe function, directly preventing command injection exploitation.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the identified command injection flaw in ZSPACE Z4Pro+ version 1.0.0440024.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Vulnerability scanning detects command injection vulnerabilities like CVE-2025-15133 in HTTP POST handlers for subsequent remediation.

Security SummaryAI

CVE-2025-15133 is a command injection vulnerability (CWE-74, CWE-77) in ZSPACE Z4Pro+ version 1.0.0440024. The affected component is the HTTP POST Request Handler, specifically the zfilev2_api_CloseSafe function at the /v2/file/safe/close endpoint. Manipulation of this function enables command injection, with the vulnerability published on 2025-12-28 and assigned a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring low attack complexity and no user interaction. Successful exploitation grants limited impacts on confidentiality, integrity, and availability, potentially allowing arbitrary command execution on the affected system. A public exploit is available and might be used in attacks.

Advisories referenced in VulDB entries (ctiid.338511, id.338511, submit.713887) and a GitHub issue (LX-66-LX/cve/issues/3) provide details on the vulnerability. The vendor was contacted early regarding this disclosure, though specific patch information is not detailed in the available references.

Details

CWE(s)
CWE-74CWE-77

Affected Products

zspace
z4pro\+ firmware
1.0.0440024

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

Command injection vulnerability in HTTP POST endpoint enables remote exploitation of public-facing application (T1190) and execution via command and scripting interpreter (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References