Threats tagged 'ghsa-qr4w-cmjh-rw2w'

A critical command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0. The flaw is due to improper processing of the 'url' argument in the /api/ZRnetwork/ping endpoint, allowing remote attackers to execute arbitrary commands. Public exploit code has been disclosed. The vendor has not responded to the vulnerability report, and no patch or remediation is currently available.