CVE-2026-28798
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
ZimaOS prior to version 1.5.3 exposes a proxy endpoint (/v1/sys/proxy) that can be abused (via an externally reachable domain using Cloudflare Tunnel) to make requests to internal localhost services. This allows unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel.
Risk Assessment
An external attacker can bypass authentication and access internal services, potentially leading to data leakage and further escalation within the internal network.
Recommendation
Upgrade ZimaOS to version 1.5.3 or later. Consider disabling or securing the proxy endpoint and restricting access to Cloudflare Tunnel.
Original NVD description (English source)
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.