ZSPACE Z4Pro+ vulnerabilities

A vulnerability was identified in ZSPACE Z4Pro+ version 1.0.0440024. The function zfilev2_api_CloseSafe in the file /v2/file/safe/close of the HTTP POST Request Handler component is affected by command injection. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.