IceWhaleTech ZimaOS vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Latest IceWhaleTech ZimaOS vulnerabilities

CVE-2026-28798 — Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS (CVSS 10.0)
CVE-2026-28442 — ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation (CVSS 8.5)
CVE-2026-28286 — ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API (CVSS 9.9)
CVE-2025-64427 — ZimaOS is vulnerable to Server-Side Request Forgery (SSRF) (CVSS 6.5)
CVE-2026-21891 — ZimaOS has Authentication Bypass via System-Level Username (CVSS 9.8)
CVE-2025-58432 — ZimaOS Privilege Escalation using localhost calls to File API Upload (CVSS 7.8)
CVE-2025-58431 — ZimaOS reads arbitrary files using localhost calls to File API Download (CVSS 6.2)
CVE-2024-49359 — ZimaOS vulnerable to Directory Listing via Parameter Manipulation (CVSS 7.5)
CVE-2024-49358 — ZimaOS vulnerable to Username Enumeration via API Responses (CVSS 5.3)
CVE-2024-49357 — ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak (CVSS 7.5)
CVE-2024-48932 — ZimaOS Unauthenticated API Discloses Usernames (CVSS 5.3)
CVE-2024-48931 — ZimaOS Arbitrary File Read via Parameter Manipulation (CVSS 7.5)