This vulnerability in Ziroom ZHOME A0101 1.0.1.0 involves command injection via the password1 parameter in the /api/ZRnetwork/set_passwd API endpoint. An attacker can remotely exploit this flaw without user interaction or privileges, potentially executing arbitrary commands on the affected system. The CVSS 4.0 score is 9.4, indicating critical severity. The vendor was notified but has not provided any fix or advisory. Exploit details have been publicly disclosed, but no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to full system compromise. Given the critical CVSS score and the nature of command injection, the impact includes unauthorized control over the device and its functions.

No official fix or patch is currently available, and the vendor has not responded to the vulnerability disclosure. Users should monitor vendor channels for updates. Until a patch is released, restricting network access to the affected API endpoint and employing network-level protections may reduce exposure.