Description
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-28
Score: 9.4 Critical
EPSS: 2.3% Low
KEV: No
Impact: Remote Code Execution via command injection
Action: Patch ASAP
AI Analysis

Impact

A command injection flaw exists in the firstLogin endpoint of Ziroom ZHOME A0101. By manipulating the firstLogin argument, an attacker can inject arbitrary commands and achieve full remote code execution. The vulnerability is classified as a severe security issue, reflected by a CVSS score of 9.4. The description does not specify authentication requirements; it is inferred that the endpoint may be reachable externally.

Affected Systems

The flaw affects Ziroom ZHOME A0101 firmware version 1.0.1.0 running on the device hardware. Only installations that have not yet applied a newer firmware release are vulnerable.

Risk and Exploitability

The vulnerability can be exploited remotely by sending a crafted request to /api/ZRnetwork/firstLogin. It is unclear whether authentication is required; the API seems publicly reachable. The EPSS score is 2% and the vulnerability is not listed in the CISA KEV catalog, yet the high CVSS rating signals a high impact. Attackers can potentially compromise the device, alter configurations, or pivot to other network assets. The risk level remains critical due to the severity and remote availability of the attack surface.

Generated by OpenCVE AI on September 30, 2026 at 04:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and apply the latest Ziroom ZHOME firmware that addresses command injection
  • If an update is unavailable, limit external access to the /api/ZRnetwork/firstLogin endpoint to trusted IP ranges or internal networks
  • Enforce strict input validation for the firstLogin parameter by whitelisting acceptable values or sanitizing input before processing

Generated by OpenCVE AI on September 30, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ziroom ZHOME A0101 firstLogin command injection
First Time appeared Ziroom
Ziroom zhome A0101
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*
Vendors & Products Ziroom
Ziroom zhome A0101
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Ziroom Zhome A0101
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-29T19:45:48.398Z

Reserved: 2026-09-28T11:30:44.075Z

Link: CVE-2026-101260

cve-icon Vulnrichment

Updated: 2026-09-29T19:45:37.517Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T23:17:00.300

Modified: 2026-09-29T20:17:11.477

Link: CVE-2026-101260

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T04:30:11Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')