Skip to content
OpenAdvisories

Product · IceWhale Tech

ZimaOS

12 known vulnerabilities.

ZimaOS at a glance

Last 12 months
5
Critical · all time
2
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability, 1 critical February 2026: 0 vulnerabilities March 2026: 3 vulnerabilities Mar April 2026: 1 vulnerability, 1 critical May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202611
Mar 202630
Feb 202600
Jan 202611
Dec 202500
Nov 202500
Oct 202500
Sep 202520
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Critical 9.1
    CVE-2026-28798

    Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunn…

    IceWhale Tech ZimaOS
  • High 8.6
    CVE-2026-28442

    ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly wi…

    IceWhale Tech ZimaOS
  • High 7.1
    CVE-2025-64427

    ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP add…

    IceWhale Tech ZimaOS
  • High 8.6
    CVE-2026-28286 Public exploit

    ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when…

    IceWhale Tech ZimaOS
  • Critical 9.4
    CVE-2026-21891 Scanner template

    ZimaOS has Authentication Bypass via System-Level Username

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password w…

    IceWhale Tech ZimaOS
  • Medium 5.2
    CVE-2025-58432

    ZimaOS Privilege Escalation using localhost calls to File API Upload

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are perfo…

    IceWhale Tech ZimaOS
  • Medium 4.8
    CVE-2025-58431

    ZimaOS reads arbitrary files using localhost calls to File API Download

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.

    IceWhale Tech ZimaOS
  • High 7.5
    CVE-2024-49359

    ZimaOS vulnerable to Directory Listing via Parameter Manipulation

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Zima_Server_IP:PORT>/v2_1/file` in ZimaOS is vulnerable to a directory traversal attack, allowing…

    IceWhale Tech ZimaOS
  • Medium 5.3
    CVE-2024-49358

    ZimaOS vulnerable to Username Enumeration via API Responses

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Server-IP>/v1/users/login` in ZimaOS returns distinct responses based on whether a username exist…

    IceWhale Tech ZimaOS
  • High 7.5
    CVE-2024-49357 Scanner template EPSS 24%

    ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://…

    IceWhale Tech ZimaOS
  • Medium 5.3
    CVE-2024-48932

    ZimaOS Unauthenticated API Discloses Usernames

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1/users/name` allows unauthenticated users to access sensitive information, such as usernames, withou…

    IceWhale Tech ZimaOS
  • High 7.5
    CVE-2024-48931

    ZimaOS Arbitrary File Read via Parameter Manipulation

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint `http://<Zima_Server_IP:PORT>/v3/file?token=<token>&files=<file_path>` is vulnerable to arbitrary f…

    IceWhale Tech ZimaOS