CVE-2026-101260 describes a command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. The issue is located in an unspecified functionality of the /api/ZRnetwork/firstLogin endpoint. By manipulating the firstLogin argument, an attacker with high privileges can remotely execute arbitrary commands on the affected system. The vulnerability has a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating network attack vector, low attack complexity, required high privileges, no user interaction, and complete confidentiality, integrity, and availability impact. Exploit code is publicly available, but there is no vendor response or patch information.

Successful exploitation allows remote command execution with high privileges, leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to its remote exploitability and high impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, organizations should consider restricting access to the vulnerable endpoint and monitor for exploitation attempts. Applying network-level controls to limit exposure may reduce risk until an official fix is released.