Zspace vulnerabilities
We track 6 vulnerabilities in Zspace products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on December 28, 2025.
Latest Zspace vulnerabilities
- 8.8 High severity
Z4Pro+: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to
- 8.8 High severity
Z4Pro+: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate
- 8.8 High severity
Z4Pro+: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from
- 8.8 High severity
Q2C NAS: Improper Neutralization of Special Elements used in a Command
A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safe_dir causes command
- 8.8 High severity
Q2C NAS: Improper Neutralization of Special Elements used in a Command
A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safe_di
- 8.8 High severity
Q2C NAS: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection.