Threat database

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-102793 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects the set_time_zone function in the /api/ZRFirmware/set_time_zone endpoint. The vulnerability arises from improper handling of the hostname/zonename argument, allowing remote attackers to execute arbitrary commands. Exploit code has been published, but no vendor response or patch is currently available.

CVE-2026-102792 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects the set_syslog function in the /api/ZRnetwork/set_syslog endpoint, where manipulation of the conloglevel or log_size arguments can lead to remote command injection. The vulnerability is publicly known and exploitable. The vendor has not responded to disclosure attempts, and no patch or remediation guidance is currently available.

CVE-2026-101264 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. The flaw exists in the /api/ZRnetwork/set_passwd endpoint where manipulation of the password1 argument allows remote attackers to execute arbitrary commands. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. Exploitation requires no user interaction and can be performed remotely with high impact on confidentiality, integrity, and availability.

CVE-2026-101263 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. The flaw exists in the processing of the /api/ZRQos/set_online_client endpoint, where manipulation of the 'mac' argument allows remote attackers to execute arbitrary commands. The vulnerability has a high CVSS score of 9.4 and public exploit code is available. The vendor has not responded to disclosure requests and no patch or mitigation has been provided.

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101261 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects an unspecified part of the /api/ZRnetwork/firstSetup_wifi endpoint, where manipulation of the login_pwd argument can lead to remote command injection. The vulnerability allows an attacker to execute arbitrary commands remotely without user interaction. The vendor was notified but did not respond, and an exploit has been published. No patch or remediation information is currently available.

CVE-2026-101260 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects the /api/ZRnetwork/firstLogin endpoint, allowing remote attackers to manipulate the firstLogin argument to execute arbitrary commands. The vulnerability is publicly known and exploitable, but the vendor has not responded or provided a fix.

CVE-2026-101187 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects the USB Device Management API function pop_usb_device in the file usr/lib/lua/luci/controller/api/zrUsb.lua. The vulnerability allows remote attackers to execute arbitrary commands by manipulating the argument path. Public exploit code is available, and the vendor has not responded to disclosure. No patch or remediation guidance is currently provided.

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This manipulation causes use of default credentials. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in Ziroom ZHOME A0101 1.0.1.0. This issue affects the function macAddrClone of the file luci\controller\api\zrMacClone.lua. The manipulation of the argument macType results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.