Vulnerabilities

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available.

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password when the provided username matches a known system service account. The application's login function fails to properly handle the password validation result for these users, effectively granting authenticated access to anyone who knows one of these common usernames and provides any password. As of time of publication, no known patched versions are available.

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.

ZimaOS, an operating system from ZimaSpace (IceWhaleTech) for Zima devices and x86-64 systems with UEFI, exposes sensitive information through API endpoints such as /v1/users/image?path=... without requiring any authentication or authorization (CWE-200, CWE-862). A remote, unauthenticated attacker who can reach the API on a device running ZimaOS 1.2.4 or any earlier version can read files such as app_order.json and system.json, revealing the list of installed applications and detailed system configuration. This disclosure gives attackers detailed knowledge of the system setup that can be used to plan further attacks against the device. All ZimaOS deployments up to and including version 1.2.4 are affected, and as of publication no patched version is available. The flaw has public proof-of-concept references and a high EPSS score (23.8% probability of exploitation within 30 days, 98th percentile), but there is no confirmed in-the-wild exploitation and it is not in CISA KEV.

Do: Since no fixed version is available yet, restrict network access to ZimaOS devices: avoid port-forwarding the ZimaOS web API to the internet and limit access to trusted LAN clients. Monitor the IceWhaleTech/ZimaOS GitHub repository or vendor channels for a patched release and upgrade as soon as one ships. To check exposure, request GET /v1/users/image?path=/var/lib/casaos/1/system.json without credentials and see whether system data is returned.