Threats tagged 'ghsa-xq84-qxfj-mw42'

CVE-2026-101264 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. The flaw exists in an unknown function within the /api/ZRnetwork/set_passwd endpoint, where manipulation of the password1 argument allows remote attackers to execute arbitrary commands. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available. Public exploit code has been disclosed, increasing the risk of exploitation.