CVE-2026-101260

Ziroom ZHOME A0101 firstLogin command injection

View on CVE.org
Published Sep 28, 2026 CVSS 4.0 · 9.4 Critical EPSS 2.3% KEV · Not listed
Description
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A command injection flaw exists in the firstLogin endpoint of Ziroom ZHOME A0101. By manipulating the firstLogin argument, an attacker can inject arbitrary commands and achieve full remote code execution. The vulnerability is classified as a severe security issue, reflected by a CVSS score of 9.4. The description does not specify authentication requirements; it is inferred that the endpoint may be reachable externally.

Affected Systems

The flaw affects Ziroom ZHOME A0101 firmware version 1.0.1.0 running on the device hardware. Only installations that have not yet applied a newer firmware release are vulnerable.

Risk and Exploitability

The vulnerability can be exploited remotely by sending a crafted request to /api/ZRnetwork/firstLogin. It is unclear whether authentication is required; the API seems publicly reachable. The EPSS score is 2% and the vulnerability is not listed in the CISA KEV catalog, yet the high CVSS rating signals a high impact. Attackers can potentially compromise the device, alter configurations, or pivot to other network assets. The risk level remains critical due to the severity and remote availability of the attack surface.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and apply the latest Ziroom ZHOME firmware that addresses command injection
  • If an update is unavailable, limit external access to the /api/ZRnetwork/firstLogin endpoint to trusted IP ranges or internal networks
  • Enforce strict input validation for the firstLogin parameter by whitelisting acceptable values or sanitizing input before processing

Generated by OpenCVE AI on September 30, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ziroom ZHOME A0101 firstLogin command injection
First Time appeared Ziroom
Ziroom zhome A0101
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*
Vendors & Products Ziroom
Ziroom zhome A0101
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 7:45 PM
Reserved
Sep 28, 2026, 11:30 AM

View source JSON

Updated
Sep 29, 2026, 7:45 PM

JSON

Status
Deferred
Published
Sep 28, 2026, 11:17 PM
Modified
Sep 29, 2026, 8:17 PM

View source JSON

No data.

Updated
Sep 30, 2026, 4:30 AM

JSON