CVE-2025-15133
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A vulnerability was identified in ZSPACE Z4Pro+ version 1.0.0440024. The function zfilev2_api_CloseSafe in the file /v2/file/safe/close of the HTTP POST Request Handler component is affected by command injection. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, potentially leading to full system compromise and data breach.
Recommendation
Contact the vendor for a patch or workaround. If possible, restrict access to the device from trusted networks.
Other vulnerabilities in ZSPACE Z4Pro+
See all- CVE-2025-15132Medium
A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2025-15131Medium
A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.
Original NVD description (English source)
A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS