A critical command injection vulnerability in ZSPACE Q2C NAS allows remote, authenticated attackers to execute arbitrary system commands, posing a significant risk of full system compromise.

This is a command injection flaw (CWE-77) located in the zfilev2_api.SafeStatus function within the HTTP POST request handler. The vulnerability is triggered by manipulating the safe_dir argument, which allows an authenticated remote attacker to inject and execute arbitrary system commands.

The vulnerability carries a CVSS score of 8.8, reflecting a high severity due to the potential for total system compromise. Successful exploitation could lead to unauthorized data access, complete loss of confidentiality and integrity for stored files, and potential pivot points for further lateral movement within the network.

Immediate Action: As no patch is currently available, administrators should restrict network access to the management interface of the Q2C NAS to trusted IP addresses only.

Proactive Monitoring: Monitor system logs for unusual HTTP POST requests directed at the /v2/file/safe/status endpoint, specifically looking for shell-related characters or command sequences within the safe_dir parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block POST requests containing suspicious input patterns in the safe_dir argument to provide virtual patching.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Given the high severity of this command injection vulnerability and the availability of a public proof-of-concept, users should treat this as a priority item. While waiting for an official vendor firmware update, implement strict network segmentation and WAF filtering to prevent remote exploitation. Monitor the vendor's security portal closely for the release of a permanent technical fix.