The ZSPACE Q2C NAS contains a critical command injection vulnerability that permits remote code execution by authenticated users.

This flaw is a command injection vulnerability (CWE-77) located within the zfilev2_api.CloseSafe function of the /v2/file/safe/close endpoint. An attacker with low-level privileges can manipulate the safe_dir parameter to execute arbitrary commands on the underlying host.

The ability to execute arbitrary commands on a Network Attached Storage device presents a significant security risk, as it allows for full system compromise, unauthorized data access, and potential lateral movement within the network. With a CVSS score of 8.8, this vulnerability is classified as high severity, and the potential for total system impact necessitates immediate attention to prevent data exfiltration or ransomware deployment.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the management interface and monitor for suspicious HTTP POST requests directed at the /v2/file/safe/close endpoint.

Proactive Monitoring: Review system logs for anomalous command execution patterns or unauthorized modifications to system files originating from the web server process.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect and filter inputs to the safe_dir parameter, blocking any requests containing suspicious shell metacharacters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the provided researcher technical write-up.

Given the confirmed existence of a public proof-of-concept and the high CVSS severity, organizations utilizing ZSPACE Q2C NAS must prioritize isolating these devices from external networks. Monitor vendor communication channels closely for the release of a security update and apply it immediately upon availability to remediate the underlying command injection flaw.