CVE-2025-58432: ZimaOS Privilege Escalation Vulnerability

CVE-2025-58432 Overview

CVE-2025-58432 affects ZimaOS, a fork of CasaOS designed for Zima devices and x86-64 systems with UEFI firmware. The vulnerability resides in the /v2_1/files/file/uploadV2 endpoint, which accepts file uploads from any user with localhost access. The upload process executes with root privileges, allowing files to be written anywhere on the filesystem with full administrative rights. Version 1.4.1 and all prior releases are affected. The flaw is categorized under [CWE-250] (Execution with Unnecessary Privileges) and stems from the absence of authentication and privilege separation on a sensitive local endpoint.

Critical Impact
Any local user or process able to reach the loopback interface can write arbitrary files as root, enabling local privilege escalation and persistent system compromise on ZimaOS appliances.

Affected Products

ZimaOS versions 1.4.1 and all prior releases
Zima devices running ZimaOS
x86-64 UEFI systems running ZimaOS

Discovery Timeline

2025-09-17 - CVE-2025-58432 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58432

Vulnerability Analysis

The vulnerability exists in the ZimaOS REST API handler at /v2_1/files/file/uploadV2. The endpoint accepts multipart file uploads without verifying caller identity or authorization scope. Because the ZimaOS service runs as root, every write inherits root ownership and permissions. An attacker with localhost reachability can place files in any directory, including /etc, /usr/bin, systemd unit paths, or cron directories. Writing an executable to a startup path or replacing a service binary yields persistent code execution at boot. This is a classic [CWE-250] violation where the operation runs with privileges far exceeding what the caller required.

Root Cause

The endpoint trusts loopback connections implicitly and performs file operations under the daemon's effective UID of 0. There is no authentication check, no path sanitization tied to a user context, and no privilege de-escalation before writing the uploaded payload. Any application, container, or low-privileged user able to bind to 127.0.0.1 and reach the API can invoke the upload.

Attack Vector

Exploitation requires local access to the ZimaOS host or to a process that can reach the loopback interface. A non-privileged local user, a misconfigured container sharing the host network namespace, or a web application exposed elsewhere on the device can issue a crafted HTTP POST request to the vulnerable endpoint. The attacker supplies a destination path and file contents; the daemon writes the data as root. Common post-exploitation steps include dropping an authorized SSH key into /root/.ssh/authorized_keys, planting a cron job, or overwriting a SUID binary. Refer to the GitHub Security Advisory GHSA-3gp9-43rg-xrcc for additional details on the endpoint behavior.

Detection Methods for CVE-2025-58432

Indicators of Compromise

HTTP POST requests to /v2_1/files/file/uploadV2 originating from non-administrative local processes or containers
Unexpected files owned by root in system directories such as /etc/cron.d/, /etc/systemd/system/, or /root/.ssh/
Modifications to system binaries or service unit files with recent timestamps that do not correspond to package manager activity
New or modified entries in /root/.ssh/authorized_keys on ZimaOS hosts

Detection Strategies

Monitor the ZimaOS API access logs for calls to the uploadV2 endpoint and correlate with the calling process or container identity
Audit filesystem changes under privileged directories using auditd rules on paths such as /etc, /usr/bin, and /root
Compare installed file hashes against known-good baselines for the running ZimaOS version

Monitoring Recommendations

Enable verbose logging on the ZimaOS HTTP service and forward logs to a centralized SIEM for review
Track outbound network connections initiated by root-owned processes that appear after recent uploads
Alert on creation of new systemd units, cron jobs, or SSH key changes on ZimaOS appliances

How to Mitigate CVE-2025-58432

Immediate Actions Required

Upgrade ZimaOS to a version later than 1.4.1 once a fixed release is available from IceWhaleTech
Restrict access to the ZimaOS management interface and ensure only trusted administrators can reach the device
Audit existing ZimaOS hosts for unauthorized files in privileged directories and rotate any potentially exposed credentials or SSH keys

Patch Information

Review the GitHub Security Advisory GHSA-3gp9-43rg-xrcc for the vendor's remediation guidance and fixed version information. Apply the upgrade through the standard ZimaOS update mechanism after verifying device backups.

Workarounds

Block external access to the ZimaOS API and limit loopback access by restricting which local accounts and containers can run on the device
Avoid running untrusted containers or applications on ZimaOS hosts until the patch is applied, since any localhost-reachable process can invoke the vulnerable endpoint
Apply host firewall rules to restrict traffic to the ZimaOS service ports to known administrative sources

bash

# Example: restrict ZimaOS API access at the host firewall (adjust port to match deployment)
iptables -A INPUT -i lo -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT
iptables -A INPUT -i lo -p tcp --dport 80 -j DROP