Description
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-29
Score: 9.4 Critical
EPSS: 2.5% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the set_time_zone function of the Ziroom ZHOME A0101 firmware. An attacker can craft an exploitative hostname or zonename value that is executed by the underlying operating system, enabling arbitrary command execution. This results in complete compromise of the device, compromising confidentiality, integrity, and availability of the system.

Affected Systems

Ziroom ZHOME A0101 firmware version 1.0.1.0 is impacted by the flaw.

Risk and Exploitability

The CVSS score of 9.4 classifies this flaw as critical. The EPSS score of 2% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV, yet a public exploit has already been published. Because the attack can be performed remotely via the /api/ZRFirmware/set_time_zone API without requiring authentication, the risk to any deployed device is high.

Generated by OpenCVE AI on September 30, 2026 at 15:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Ziroom ZHOME A0101 device to a firmware version that patches the set_time_zone function.
  • If an upgrade is not immediately possible, block or restrict access to the /api/ZRFirmware/set_time_zone endpoint so that only trusted management hosts can reach it.
  • Apply firewall or network segmentation rules to limit external network traffic that can reach the device's API endpoints.
  • Monitor device logs for unexpected command execution attempts and audit the system for unauthorized changes.

Generated by OpenCVE AI on September 30, 2026 at 15:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ziroom ZHOME A0101 set_time_zone command injection
First Time appeared Ziroom
Ziroom zhome A0101
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*
Vendors & Products Ziroom
Ziroom zhome A0101
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Ziroom Zhome A0101
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-01T15:51:28.128Z

Reserved: 2026-09-29T16:51:37.673Z

Link: CVE-2026-102793

cve-icon Vulnrichment

Updated: 2026-09-30T18:14:46.759Z

cve-icon NVD

Status : Deferred

Published: 2026-09-30T00:16:33.743

Modified: 2026-10-01T16:17:35.247

Link: CVE-2026-102793

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T15:15:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')