CVE-2025-15131
Published: 28 December 2025
Summary
CVE-2025-15131 is a low-severity Injection (CWE-74) vulnerability in Zspace Z4Pro\+ Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-15131 is a command injection vulnerability affecting ZSPACE Z4Pro+ version 1.0.0440024. The issue resides in the zfilev2_api_SafeStatus function within the /v2/file/safe/status endpoint of the HTTP POST Request Handler component. Published on 2025-12-28, it is associated with CWEs-74 and CWE-77 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), rated as medium severity.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, allowing command injection via manipulated HTTP POST requests to the affected endpoint.
Advisories from VulDB (ctiid.338509, id.338509, submit.713874) and a GitHub issue (LX-66-LX/cve/issues/1) document the vulnerability, noting that the vendor was contacted early about the disclosure. No specific patch or mitigation details are outlined in the available information.
The exploit has been made public and could be used by attackers, increasing the risk for unpatched ZSPACE Z4Pro+ deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205505
Vulnerability details
A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has…
more
been made public and could be used. The vendor was contacted early about this disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in HTTP POST endpoint of web service directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary command execution via T1059 (Command and Scripting Interpreter).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates and sanitizes HTTP POST request inputs to the zfilev2_api_SafeStatus endpoint, directly preventing command injection exploitation.
Mandates timely remediation of the specific command injection flaw in ZSPACE Z4Pro+ version 1.0.0440024 via patching or workarounds.
Enforces least privilege on the HTTP POST Request Handler process, limiting the scope and impact of any successful command injection by low-privilege (PR:L) attackers.