Description
A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-28
Score: 9.4 Critical
EPSS: 2.3% Low
KEV: No
Impact: Remote Command Injection
Action: Patch Now
AI Analysis

Impact

The vulnerability allows an attacker to inject and execute arbitrary system commands by manipulating the "mac" parameter of the /api/ZRQos/set_online_client endpoint. This leads to full code execution on the Ziroom ZHOME A0101 device, exposing confidentiality, integrity, and availability of the system. The CVSS score of 9.4 indicates that the flaw is considered critical.

Affected Systems

The issue affects Ziroom ZHOME A0101 devices running firmware version 1.0.1.0. No other versions are listed as affected.

Risk and Exploitability

The flaw can be triggered remotely over the device’s HTTP interface, making it reachable from outside the local network if exposed. The EPSS score is 2% and the vulnerability is not listed in CISA KEV, so the overall risk is driven by the high CVSS score and the public availability of an exploitation script. Attackers can potentially gain full control of the device out of band by sending a crafted request to the vulnerable API endpoint.

Generated by OpenCVE AI on September 30, 2026 at 04:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device firmware to the latest version or apply the vendor patch that resolves the command injection issue.
  • Restrict or block access to the /api/ZRQos/set_online_client endpoint from untrusted networks by configuring network firewalls or the device’s access control settings.
  • Implement monitoring of command execution logs and network traffic from the device to detect anomalous activity that may indicate exploitation.

Generated by OpenCVE AI on September 30, 2026 at 04:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ziroom ZHOME A0101 set_online_client command injection
First Time appeared Ziroom
Ziroom zhome A0101
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*
Vendors & Products Ziroom
Ziroom zhome A0101
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Ziroom Zhome A0101
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-29T19:18:58.874Z

Reserved: 2026-09-28T11:31:25.871Z

Link: CVE-2026-101263

cve-icon Vulnrichment

Updated: 2026-09-29T19:18:49.215Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T00:17:01.540

Modified: 2026-09-29T20:17:11.630

Link: CVE-2026-101263

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T04:30:11Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')