CVE-2025-14106

CVE-2025-14106 is a high-severity command injection vulnerability affecting ZSPACE Q2C NAS devices up to version 1.1.0210050. Specifically, the zfilev2_api.CloseSafe function within the HTTP POST Request Handler is susceptible to manipulation of the safe_dir argument. This flaw allows for remote command injection, enabling an unauthenticated attacker to execute arbitrary commands on the affected system. The vulnerability carries a CVSS score of 8.8 (HIGH), indicating a critical risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not yet observed in active exploitation, a public exploit is available, increasing the likelihood of future attacks. The vendor has acknowledged the vulnerability and plans to release a technical fix.