CVE-2024-49357

ZimaOS, an operating system from ZimaSpace (IceWhaleTech) for Zima devices and x86-64 systems with UEFI, exposes sensitive information through API endpoints such as /v1/users/image?path=... without requiring any authentication or authorization (CWE-200, CWE-862). A remote, unauthenticated attacker who can reach the API on a device running ZimaOS 1.2.4 or any earlier version can read files such as app_order.json and system.json, revealing the list of installed applications and detailed system configuration. This disclosure gives attackers detailed knowledge of the system setup that can be used to plan further attacks against the device. All ZimaOS deployments up to and including version 1.2.4 are affected, and as of publication no patched version is available. The flaw has public proof-of-concept references and a high EPSS score (23.8% probability of exploitation within 30 days, 98th percentile), but there is no confirmed in-the-wild exploitation and it is not in CISA KEV.

What to do: Since no fixed version is available yet, restrict network access to ZimaOS devices: avoid port-forwarding the ZimaOS web API to the internet and limit access to trusted LAN clients. Monitor the IceWhaleTech/ZimaOS GitHub repository or vendor channels for a patched release and upgrade as soon as one ships. To check exposure, request GET /v1/users/image?path=/var/lib/casaos/1/system.json without credentials and see whether system data is returned.