CVE-2026-101263

Ziroom ZHOME A0101 set_online_client command injection

View on CVE.org
Published Sep 28, 2026 CVSS 4.0 · 9.4 Critical EPSS 2.3% KEV · Not listed
Description
A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability allows an attacker to inject and execute arbitrary system commands by manipulating the "mac" parameter of the /api/ZRQos/set_online_client endpoint. This leads to full code execution on the Ziroom ZHOME A0101 device, exposing confidentiality, integrity, and availability of the system. The CVSS score of 9.4 indicates that the flaw is considered critical.

Affected Systems

The issue affects Ziroom ZHOME A0101 devices running firmware version 1.0.1.0. No other versions are listed as affected.

Risk and Exploitability

The flaw can be triggered remotely over the device’s HTTP interface, making it reachable from outside the local network if exposed. The EPSS score is 2% and the vulnerability is not listed in CISA KEV, so the overall risk is driven by the high CVSS score and the public availability of an exploitation script. Attackers can potentially gain full control of the device out of band by sending a crafted request to the vulnerable API endpoint.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device firmware to the latest version or apply the vendor patch that resolves the command injection issue.
  • Restrict or block access to the /api/ZRQos/set_online_client endpoint from untrusted networks by configuring network firewalls or the device’s access control settings.
  • Implement monitoring of command execution logs and network traffic from the device to detect anomalous activity that may indicate exploitation.

Generated by OpenCVE AI on September 30, 2026 at 04:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ziroom ZHOME A0101 set_online_client command injection
First Time appeared Ziroom
Ziroom zhome A0101
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*
Vendors & Products Ziroom
Ziroom zhome A0101
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 7:18 PM
Reserved
Sep 28, 2026, 11:31 AM

View source JSON

Updated
Sep 29, 2026, 7:18 PM

JSON

Status
Deferred
Published
Sep 29, 2026, 12:17 AM
Modified
Sep 29, 2026, 8:17 PM

View source JSON

No data.

Updated
Sep 30, 2026, 4:30 AM

JSON