CVE-2025-69431
Unknown Unknown - Not Provided
Symbolic Link Vulnerability in ZSPACE Q2C NAS Enables Data Tampering

Publication date: 2026-02-03

Last updated on: 2026-02-11

Assigner: MITRE

Description
The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, and then access the USB drive's directory mounted on the NAS using the Samba protocol. This allows them to obtain all files within the NAS system and tamper with those files.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-03
Last Modified
2026-02-11
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-15
NVD
CVE-2025-69431
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
zspace q2c_firmware to 1.1.0210050 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The ZSPACE Q2C NAS has a vulnerability involving incorrect handling of symbolic links. An attacker can format a USB drive with the ext4 filesystem, create a symbolic link pointing to the root directory of that drive, and then insert the USB drive into the NAS device. The NAS mounts the USB drive and exposes its directory via the Samba protocol, allowing the attacker to access the USB drive's directory through the NAS.

This process enables the attacker to bypass normal access controls and gain access to files within the NAS system by following the symbolic link, potentially leading to unauthorized file access and tampering.

Impact Analysis

This vulnerability can allow an attacker to obtain all files stored within the NAS system and tamper with them. This means sensitive or critical data could be accessed, modified, or corrupted without authorization.

Such unauthorized access and tampering can lead to data breaches, loss of data integrity, disruption of services, and potential exposure of confidential information.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart