This vulnerability affects Ziroom ZHOME A0101 version 1.0.1.0 specifically in the set_syslog function accessed via /api/ZRnetwork/set_syslog. By manipulating the conloglevel or log_size parameters, an attacker can perform command injection remotely without user interaction or privileges beyond high privileges (PR:H). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor was contacted but did not respond, and no patch or mitigation has been published. Public exploit code is available.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the device. Given the critical CVSS score and public exploit availability, affected systems are at high risk.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, users should consider isolating affected devices from untrusted networks and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.