ZSPACE Q2C NAS Command Injection Vulnerability in HTTP POST Request Handler

A command injection vulnerability has been identified in ZSPACE Q2C NAS devices running firmware versions through 1.1.0210050. The issue arises in the HTTP POST request handler, specifically within the 'zfilev2_api.CloseSafe' function. The vulnerability allows remote attackers to manipulate the 'safe_dir' argument, injecting and executing arbitrary commands on the affected device. Exploitation of this vulnerability could lead to unauthorized command execution with root privileges, allowing complete control over the victim's NAS.

Impact

Exploitation of this vulnerability allows for unauthorized remote command execution on the affected device, with root privileges, enabling full control over the NAS.