Threats tagged 'ghsa-qxpw-frxp-639m'

CVE-2026-101261 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects an unspecified part of the /api/ZRnetwork/firstSetup_wifi endpoint, where manipulation of the login_pwd argument can lead to remote command injection. The vulnerability allows an attacker to execute arbitrary commands remotely without user interaction. The vendor was notified but did not respond, and an exploit has been published. No patch or remediation information is currently available.