CVE-2025-69431

The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following

Medium · published February 3, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, and then access the USB drive's directory mounted on the NAS using the Samba protocol. This allows them to obtain all files within the NAS system and tamper with those files.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.3th percentile
Published
2026-02-03T00:00Z
EPSS history
Timeline
  • 03 FEB 00:00Z
    The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following
    cvelistv5