Author: Ameeba

Overview

This report outlines a critical vulnerability found in ZimaOS, a fork of CasaOS, specifically used on Zima devices and x86-64 systems with UEFI. The vulnerability, designated as CVE-2025-58432, allows for unauthorized file upload from any user having access to localhost. Given its severity, the vulnerability poses a significant risk to system security, potentially leading to system compromise or data leakage.

Vulnerability Summary

CVE ID: CVE-2025-58432
Severity: High (7.8/10)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage

Affected Products

Product | Affected Versions

ZimaOS | 1.4.1 and prior versions

How the Exploit Works

The vulnerability lies in the /v2_1/files/file/uploadV2 endpoint of ZimaOS. This endpoint allows file uploads from any user who can access localhost. More importantly, these file uploads are performed with root privileges, bypassing the typical security measures in place. As such, an attacker could exploit this to upload malicious files or scripts, potentially leading to system compromise or data leakage.

Conceptual Example Code

Below is a conceptual example of how this vulnerability might be exploited:

POST /v2_1/files/file/uploadV2 HTTP/1.1
Host: localhost
Content-Type: application/octet-stream
{ "file": "<malicious_file>", "filename": "<chosen_filename>" }

In the above example, an attacker could replace `` and `` with a malicious file and a chosen filename, respectively, to exploit the vulnerability.

Mitigation

Users are advised to apply vendor patches as soon as they become available. In the interim, the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation measure. These systems can monitor and block suspicious activity, helping to prevent the exploitation of this vulnerability.

Overview

This report investigates a significant cybersecurity vulnerability, known as CVE-2025-9450, which affects SOLIDWORKS eDrawings, a popular CAD application. The flaw, a Use of Uninitialized Variable vulnerability, could allow an attacker to execute arbitrary code leading to potential system compromise or data leakage. Given the widespread use of SOLIDWORKS eDrawings, the impact of this vulnerability could be far-reaching and severe.

Vulnerability Summary

CVE ID: CVE-2025-9450
Severity: High (7.8)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

SOLIDWORKS eDrawings | Release SOLIDWORKS Desktop 2025

How the Exploit Works

The flaw resides in the JT file reading procedure in SOLIDWORKS eDrawings. If an attacker crafts a malicious JT file, and the user opens it using the affected software, an uninitialized variable within the application could be exploited. This exploitation could allow an attacker to execute arbitrary code, leading to potential system compromise or data leakage.

Conceptual Example Code

Here’s a
conceptual
example of how the vulnerability might be exploited:

// The attacker crafts a malicious JT file
malicious_jt_file = create_malicious_jt_file();
// The user opens the malicious JT file
open_jt_file(malicious_jt_file);
// This triggers the use of an uninitialized variable, which the attacker can exploit
exploit_uninitialized_variable();
// The attacker can now execute arbitrary code
execute_arbitrary_code();

Mitigation Guidance

Users of SOLIDWORKS eDrawings are advised to apply the vendor patch as soon as possible to mitigate the risks associated with this vulnerability. As a temporary mitigation measure, users can implement a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to detect and prevent any potential exploitation attempts.

Overview

CVE-2025-9447 refers to an Out-Of-Bounds Read vulnerability found within the PAR file reading procedure of SOLIDWORKS eDrawings – a popular CAD software. This vulnerability can potentially allow attackers to execute arbitrary code, leading to a serious breach of system security. It is crucial to address this vulnerability due to the high risk it poses to data integrity and system stability.

Vulnerability Summary

CVE ID: CVE-2025-9447
Severity: High (CVSS: 7.8)
Attack Vector: Local
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise and data leakage

Affected Products

Product | Affected Versions

SOLIDWORKS eDrawings | Desktop 2025

How the Exploit Works

The exploit is based on an Out-Of-Bounds Read vulnerability in the PAR file reading procedure of SOLIDWORKS eDrawings. An attacker crafts a malicious PAR file and manipulates a user into opening it using the affected software. Once the file is opened, the vulnerability allows the attacker to execute arbitrary code, potentially compromising the system or causing data leakage.

Conceptual Example Code

This is a conceptual example of how an attack might occur. The attacker would craft a malicious PAR file

$ cat << EOF > exploit.par
[Insert malicious code here]
EOF

Then, the attacker would convince the user to open this malicious PAR file using the vulnerable version of SOLIDWORKS eDrawings. When the user opens the file, the malicious code gets executed, thereby exploiting the vulnerability.

Mitigation

To mitigate this vulnerability, users are advised to apply the vendor-provided patch as soon as possible. In the interim, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation. Regularly updating and patching software is vital to maintaining a secure system environment.

Overview

The CVE-2025-54262 is a critical vulnerability that affects Substance3D – Stager versions 3.1.3 and earlier. The vulnerability allows an attacker to execute arbitrary code in the context of the current user, potentially leading to data leakage or full system compromise. It’s crucial to address this vulnerability due to its high severity and broad impact.

Vulnerability Summary

CVE ID: CVE-2025-54262
Severity: High, CVSS 7.8
Attack Vector: File-based
Privileges Required: None
User Interaction: Required
Impact: Potential execution of arbitrary code, data leakage, or full system compromise

Affected Products

Product | Affected Versions

Substance3D – Stager | 3.1.3 and earlier

How the Exploit Works

The exploit works by an attacker crafting a malicious file that causes an out-of-bounds read when parsed by Substance3D – Stager. This read past the end of an allocated memory structure allows the attacker to execute arbitrary code in the context of the current user.

Conceptual Example Code

Below is a conceptual example of a malicious file that could trigger the vulnerability. This is not actual code, but rather a representation of what a malicious payload might look like:

# Crafted file with malicious payload
file_header = 'Substance3D File'
payload = 'A' * 1024 * 1024  # Oversized payload resulting in out-of-bounds read
file_content = file_header + payload
# Save to file
with open('malicious.s3d', 'w') as f:
f.write(file_content)

This crafted file, when opened by a victim using an affected version of Substance3D – Stager, would trigger the out-of-bounds read vulnerability and potentially allow the attacker to execute arbitrary code.

Mitigation Guidance

Users are advised to apply the vendor-supplied patch as soon as possible. As a temporary mitigation, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used to detect and block attempts to exploit this vulnerability.