CVE-2026-102794

Ziroom ZHOME A0101 ping command injection

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 9.4 Critical EPSS 2.4% KEV · Not listed
Description
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A command injection flaw exists in the Ziroom ZHOME A0101 smart home gateway firmware 1.0.1.0, specifically the /api/ZRnetwork/ping endpoint. The endpoint accepts a URL parameter that is passed directly to the system shell, enabling an attacker to craft a malicious URL that causes arbitrary shell commands to run. The flaw can lead to full compromise of the device and any network that the gateway controls. The weakness covers improper input neutralization (CWE‑74) and direct command injection (CWE‑77).

Affected Systems

Only the Ziroom ZHOME A0101 model running firmware 1.0.1.0 is known to be affected. The device exposes the vulnerable API over HTTP. The description does not mention authentication requirements, so the endpoint can be reached by any host that can send HTTP traffic to the device.

Risk and Exploitability

The CVSS score of 9.4 places the vulnerability in the Critical range, indicating a catastrophic impact if exploited. An EPSS score of 2% shows a low but nonzero likelihood of real‑world attacks. The flaw is not listed in the CISA KEV catalog, but its remote nature and ability to execute arbitrary code warrant urgent attention. Attackers can exploit the vulnerability by sending a crafted HTTP request to the /api/ZRnetwork/ping endpoint, which will cause the device to execute the supplied shell command.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for an official firmware update that addresses the command injection flaw and install it if available.
  • If no patch exists, restrict access to the /api/ZRnetwork/ping endpoint by configuring firewall or router rules to allow traffic only from trusted internal devices.
  • If the gateway firmware exposes a setting, disable the ping API or enforce strict input validation so that shell metacharacters are rejected; if such a configuration is not available, isolate the device in a separate network segment or block the API entirely.
  • Monitor device logs and network traffic for anomalous ping requests or repeated attempts to invoke the API, and investigate any suspicious activity promptly.

Generated by OpenCVE AI on September 30, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ziroom ZHOME A0101 ping command injection
First Time appeared Ziroom
Ziroom zhome A0101
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*
Vendors & Products Ziroom
Ziroom zhome A0101
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 30, 2026, 1:58 PM
Reserved
Sep 29, 2026, 4:52 PM

View source JSON

Updated
Sep 30, 2026, 1:58 PM

JSON

Status
Deferred
Published
Sep 30, 2026, 12:16 AM
Modified
Sep 30, 2026, 2:17 PM

View source JSON

No data.

Updated
Sep 30, 2026, 9:30 PM

JSON