VULNERABILITY INTELLIGENCE

CVE-2025-15131

CVSS score6.3 MEDIUM

EPSS probability7.64%

CISA KEVNot currently listed

Published2025-12-28

Last modified2026-10-07

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Description

A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Weakness classification

cna@vuldb.com: CWE-74
nvd@nist.gov: CWE-77

Primary references

cna@vuldb.com — Exploit, Issue Tracking, Third Party Advisory
cna@vuldb.com — Permissions Required, VDB Entry
cna@vuldb.com — Third Party Advisory, VDB Entry
cna@vuldb.com — Third Party Advisory, VDB Entry