| शीर्षक | ZSPACE Z4Pro+ v1.0.0440024 Command Injection |
|---|
| विवरण | A binary vulnerability exists in the ZSPACE Z4pro+ NAS device (Firmware v1.0.0440024), leading to Remote Command Execution (RCE). A remote attacker can send a specially crafted POST request to the /v2/file/safe/close interface to inject and execute arbitrary malicious commands on the remote target device. This allows the attacker to gain the highest ROOT privileges and completely control the victim's NAS device. |
|---|
| स्रोत | ⚠️ https://github.com/LX-66-LX/cve/issues/3 |
|---|
| उपयोगकर्ता | LX-66-LX (UID 92717) |
|---|
| सबमिशन | 12/12/2025 07:14 AM (10 महीनों पहले) |
|---|
| संयम | 27/12/2025 10:36 AM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338511 [ZSPACE Z4Pro+ 1.0.0440024 HTTP POST Request /v2/file/safe/close zfilev2_api_CloseSafe अधिकार वृद्धि] |
|---|
| अंक | 19 |
|---|