A critical command injection vulnerability in ZSPACE Q2C NAS allows remote attackers to execute arbitrary system commands, posing a severe risk to device integrity and data confidentiality.

This is a command injection flaw (CWE-77) triggered via an HTTP POST request to the /v2/file/safe/open endpoint. The vulnerability exists within the zfilev2_api.OpenSafe function, which fails to properly sanitize the safe_dir argument, allowing low-privileged authenticated users to execute arbitrary commands.

The ability to execute arbitrary commands on a Network Attached Storage (NAS) device can lead to a complete compromise of stored data, unauthorized access to internal network resources, and potential lateral movement. With a CVSS score of 8.8, this vulnerability represents a high severity risk that could result in total system takeover and significant operational downtime.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the management interface and the vulnerable /v2/file/safe/open endpoint to trusted IP addresses only.

Proactive Monitoring: Monitor device logs for unusual HTTP POST requests directed at the /v2/file/safe/open endpoint, specifically looking for shell metacharacters or unexpected parameters in the safe_dir field.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to identify and block command injection patterns in POST request parameters, providing a virtual patch until the vendor releases a firmware update.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the vulnerability references.

Due to the availability of a public proof-of-concept and the high-impact nature of command injection, this vulnerability requires immediate attention. Organizations should prioritize isolating affected NAS devices from public-facing networks and monitor for vendor announcements regarding a firmware patch to permanently remediate the issue.