CVE-2025-15132Medium· 6.3▾ SunlitA vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 1.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
7.6%
Last analysed / modified upstream
A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
z4pro+_firmware <= 1.0.0440024Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-15133Medium· 6.3A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024
CVE-2025-15131Medium· 6.3A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024
CVE-2025-14108High· 8.8A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050
CVE-2025-14107High· 8.8A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050
CVE-2025-14106High· 8.8A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050
CVE-2025-10963Medium· 6.3A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425