CVE-2025-15131

Name of the Vulnerable Software and Affected Versions ZSPACE Z4Pro+ version 1.0.0440024

Description A command injection issue exists in ZSPACE Z4Pro+. The issue is located within the HTTP POST Request Handler component, specifically in the zfilev2 api SafeStatus function accessible via the /v2/file/safe/status API endpoint. Remote attackers can exploit this to execute arbitrary commands. The exploit has been publicly released.

Recommendations Versions prior to 1.0.0440024 should be upgraded. As a temporary workaround, consider disabling the zfilev2 api SafeStatus function until a patch is available. Restrict access to the /v2/file/safe/status API endpoint to minimize the risk of exploitation.