← Back

CVE-2025-69431

nvd nist
Published: Feb 3, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 0.9 / Impact: 5.2
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, and then access the USB drive's directory mounted on the NAS using the Samba protocol. This allows them to obtain all files within the NAS system and tamper with those files.

Affected (1)

Products: Zspace: Q2c Firmware
Zspace
1 product
Q2c Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Q2c Firmware
Up to 1.1.0210050
Running on/withPlatform Versions
Zspace
Q2c
All versions

Related CWEs

CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (1)

Source: cve@mitre.org
ExploitThird Party Advisory

Timeline

No history available yet.