Log in Start free

Vulnerability · Published Dec 7, 2025 · Assigned by VulDB

CVE-2025-14184SGAI Space1 NAS N1211DS gsaiagent JSONAPI NGNIX_UPLOAD command injection

Medium 6.3

In plain English

A medium-severity command injection in Space1 NAS N1211DS from SGAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)2.2%top 17.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in SGAI Space1 NAS N1211DS up to 1.0.915. Impacted is the function RENAME_FILE/OPERATE_FILE/NGNIX_UPLOAD of the file /cgi-bin/JSONAPI of the component gsaiagent. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
SGAI Space1 NAS N1211DS 1.0.915

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References