A command injection flaw exists in the set_syslog API endpoint of Ziroom ZHOME A0101 firmware 1.0.1.0. The conloglevel and log_size parameters are passed directly to the operating system without proper sanitization, enabling an attacker to execute arbitrary shell commands. This capability allows compromise of the device’s confidentiality, integrity, and availability.

The defect is limited to Ziroom ZHOME A0101 devices running firmware version 1.0.1.0. Any device that exposes the /api/ZRnetwork/set_syslog endpoint to a network, whether internal or external, is vulnerable. The device is commonly deployed as a smart home hub in residential or commercial environments.

With a CVSS score of 9.4, the vulnerability is considered critical. The publicly available exploit shows it can be triggered from a remote system that has network access to the exposed HTTP endpoint. The EPSS score is 3%, and the issue is not listed in CISA’s KEV catalog. The attack vector is remote; successful exploitation would permit arbitrary system command execution on the device. The CVE description does not specify authentication requirements; it is inferred that the vulnerability can be abused without authentication, but this has not been formally confirmed.