CVE-2026-101262 describes a command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. The flaw is located in the /api/ZRQos/set_online_client endpoint where manipulation of the 'ip' argument enables remote command execution. The vulnerability has a CVSS 3.1 score of 9.1, indicating high impact on confidentiality, integrity, and availability. The vendor has not provided a response or patch, and no official remediation guidance is available. Public exploit disclosure exists, but no confirmed active exploitation has been reported.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. Given the high CVSS score and remote attack vector, this vulnerability poses a significant risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing network-level protections such as restricting access to the vulnerable endpoint and monitoring for suspicious activity until an official fix is released.