---
id: CVE-2025-14106
title: A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050
summary: >-
  A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected
  is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the
  component HTTP POST Request Handler. The manipulation of the argument safe_dir
  lead…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-74
  - CWE-77
  - CWE-77
vendor: zspace
product: q2c_nas_firmware
affected:
  - q2c_nas_firmware <= 1.1.0210050
published: '2025-12-05'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:10:00.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14106'
references:
  - url: 'https://vuldb.com/?ctiid.334488'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.334488'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.697141'
    label: cna@vuldb.com
  - url: 'https://www.notion.so/2af6cf4e528a80bab847dcc1fb677590'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.12088
epssPercentile: 0.96003
ingestedAt: '2026-09-25T23:21:16.900Z'
---

## Overview

A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.

## Affected

- `q2c_nas_firmware <= 1.1.0210050`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.