Description
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-29
Score: 9.4 Critical
EPSS: 2.4% Low
KEV: No
Impact: Remote Command Execution
Action: Patch Immediately
AI Analysis

Impact

A command injection flaw exists in the Ziroom ZHOME A0101 smart home gateway firmware 1.0.1.0, specifically the /api/ZRnetwork/ping endpoint. The endpoint accepts a URL parameter that is passed directly to the system shell, enabling an attacker to craft a malicious URL that causes arbitrary shell commands to run. The flaw can lead to full compromise of the device and any network that the gateway controls. The weakness covers improper input neutralization (CWE‑74) and direct command injection (CWE‑77).

Affected Systems

Only the Ziroom ZHOME A0101 model running firmware 1.0.1.0 is known to be affected. The device exposes the vulnerable API over HTTP. The description does not mention authentication requirements, so the endpoint can be reached by any host that can send HTTP traffic to the device.

Risk and Exploitability

The CVSS score of 9.4 places the vulnerability in the Critical range, indicating a catastrophic impact if exploited. An EPSS score of 2% shows a low but nonzero likelihood of real‑world attacks. The flaw is not listed in the CISA KEV catalog, but its remote nature and ability to execute arbitrary code warrant urgent attention. Attackers can exploit the vulnerability by sending a crafted HTTP request to the /api/ZRnetwork/ping endpoint, which will cause the device to execute the supplied shell command.

Generated by OpenCVE AI on September 30, 2026 at 21:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for an official firmware update that addresses the command injection flaw and install it if available.
  • If no patch exists, restrict access to the /api/ZRnetwork/ping endpoint by configuring firewall or router rules to allow traffic only from trusted internal devices.
  • If the gateway firmware exposes a setting, disable the ping API or enforce strict input validation so that shell metacharacters are rejected; if such a configuration is not available, isolate the device in a separate network segment or block the API entirely.
  • Monitor device logs and network traffic for anomalous ping requests or repeated attempts to invoke the API, and investigate any suspicious activity promptly.

Generated by OpenCVE AI on September 30, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ziroom ZHOME A0101 ping command injection
First Time appeared Ziroom
Ziroom zhome A0101
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*
Vendors & Products Ziroom
Ziroom zhome A0101
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Ziroom Zhome A0101
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-30T13:58:27.771Z

Reserved: 2026-09-29T16:52:45.849Z

Link: CVE-2026-102794

cve-icon Vulnrichment

Updated: 2026-09-30T13:58:24.457Z

cve-icon NVD

Status : Deferred

Published: 2026-09-30T00:16:34.963

Modified: 2026-09-30T14:17:24.647

Link: CVE-2026-102794

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T21:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')