The CVE identifies a command injection vulnerability in the /api/ZRnetwork/firstSetup_wifi endpoint of Ziroom ZHOME A0101 1.0.1.0. By manipulating the login_pwd argument, an attacker can inject arbitrary shell commands that the device will execute. This flaw is a classic example of CWE‑74 (Improper Neutralization of Special Elements used in an Output Context) combined with CWE‑77 (Execution of Arbitrary Commands). It can lead to complete compromise of the device and any connected smart‑home services, exposing confidentiality, integrity, and availability.

Affected assets are Ziroom ZHOME A0101 units running firmware version 1.0.1.0. The vulnerability exists in the /api/ZRnetwork/firstSetup_wifi endpoint and applies to any unit that runs this firmware, regardless of network location if the endpoint is exposed.

The CVSS score of 9.4 indicates an extremely high severity, and the EPSS score of 4% reflects a low but non‑zero likelihood of exploitation. The flaw is exploitable remotely, and an exploit has already been published. Although the product is not listed in the CISA KEV catalog, the potential for full remote code execution represents a critical risk for devices that allow or expose the vulnerable endpoint.