This vulnerability allows an attacker to remotely execute arbitrary commands on Ziroom ZHOME A0101 devices by manipulating the login_pwd parameter in the /api/ZRnetwork/firstSetup_wifi API endpoint. The vulnerability affects version 1.0.1.0 of the product. The vendor was notified but has not issued any response or patch. The CVSS 4.0 base score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. Exploit code is publicly available.

Successful exploitation can lead to remote command execution on affected devices, potentially compromising confidentiality, integrity, and availability of the system. Given the critical CVSS score and the nature of command injection, attackers could fully control the device or network segment it resides on.

No official fix or patch is currently available from the vendor. Since the vendor has not responded to the disclosure, users should consider isolating affected devices from untrusted networks and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.