CVE-2025-14184
BaseFortify
Publication date: 2025-12-07
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sgai | gsaiagent | * |
| sgai | space1_nas | n1211ds |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for suspicious requests to the /cgi-bin/JSONAPI endpoint, especially those invoking the RENAME_FILE, OPERATE_FILE, or NGNIX_UPLOAD commands with unusual or malicious payloads. Since the vulnerability allows command injection via crafted filenames or path parameters, network intrusion detection systems (NIDS) can be configured to alert on HTTP requests containing suspicious command injection patterns targeting these functions. Specific commands to detect exploitation attempts could include using tools like curl or wget to simulate or capture suspicious requests, or using grep to search web server logs for requests to /cgi-bin/JSONAPI containing keywords like RENAME_FILE, OPERATE_FILE, or NGNIX_UPLOAD combined with shell metacharacters (e.g., ;, &, |). For example, on a Linux system, you might run: 1) grep -iE 'RENAME_FILE|OPERATE_FILE|NGNIX_UPLOAD' /var/log/nginx/access.log 2) grep -E '[;&|]' /var/log/nginx/access.log | grep '/cgi-bin/JSONAPI' 3) Use network monitoring tools to capture HTTP traffic and filter for suspicious payloads targeting these commands. However, no specific detection commands or signatures are provided in the resources. [1, 2, 3, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include discontinuing use of the affected SGAI Space1 NAS N1211DS device running firmware version up to 1.0.915, as no vendor patch or known countermeasures exist. It is recommended to replace the affected product to avoid exploitation. Additionally, restricting network access to the device, especially blocking remote access to the /cgi-bin/JSONAPI endpoint, can reduce exposure. Monitoring for suspicious activity and applying network-level protections such as firewalls or intrusion prevention systems to detect and block exploitation attempts are advisable. Since the vendor did not respond and no patches are available, replacement and network access restrictions are the primary mitigations. [4]
Can you explain this vulnerability to me?
This vulnerability exists in the SGAI Space1 NAS N1211DS device up to version 1.0.915, specifically in the gsaiagent component's /cgi-bin/JSONAPI file within the functions RENAME_FILE, OPERATE_FILE, and NGNIX_UPLOAD. It allows an attacker to perform command injection remotely, meaning they can execute arbitrary commands on the device by exploiting this flaw.
How can this vulnerability impact me? :
The vulnerability can allow a remote attacker to execute arbitrary commands on the affected device, potentially leading to unauthorized control, data manipulation, or disruption of services. This could compromise the confidentiality, integrity, and availability of the system and its data.