Threats tagged 'ghsa-qh32-hcjf-q463'

Ziroom ZHOME A0101 version 1.0.1.0 contains a critical command injection vulnerability in the /api/ZRQos/set_online_client endpoint. The vulnerability arises from improper handling of the 'mac' argument, allowing remote attackers to execute arbitrary commands. Exploit code has been publicly disclosed. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available.