Description
A security flaw has been discovered in Ziroom ZHOME A0101 1.0.1.0. This issue affects the function macAddrClone of the file luci\controller\api\zrMacClone.lua. The manipulation of the argument macType results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-02-03
Score: 6.9 Medium
EPSS: 2.2% Low
KEV: No
Impact: Remote Command Execution via Command Injection
Action: Patch or Mitigate
AI Analysis

Impact

The Ziroom ZHOME A0101 router firmware 1.0.1.0 contains a flaw in the macAddrClone Lua script that accepts the macType parameter without any sanitization. The vulnerability permits an attacker to embed arbitrary shell commands into the system call that the script performs, resulting in Remote Command Execution with the privileges of the web server process. The weakness is classified as CWE‑74 (Improper Sanitization) and CWE‑77 (Command Injection).

Affected Systems

The only affected product listed is the Ziroom ZHOME A0101 router running firmware version 1.0.1.0. No other firmware revisions or device models are mentioned in the CNA data. The vendor has not released a patch or fix, and no official workaround has been provided.

Risk and Exploitability

The CVSS base score of 6.9 indicates a moderate severity vulnerability. The EPSS score of 2 % indicates that exploitation attempts are possible but unlikely, and the vulnerability is not yet in the CISA KEV catalogue. Public exploits have been published, and the description states that the attack can be launched remotely. It is unclear whether authentication is required; the text does not specify this, so the factor is unknown and inferred from the lack of detail. Because the vulnerability is remotely exploitable, the risk to affected systems is significant if the system is reachable from untrusted networks.

Generated by OpenCVE AI on April 18, 2026 at 19:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Ziroom firmware to the latest version that includes a fix for the macAddrClone command injection if available from the vendor or community.
  • If a patch is not yet available, restrict remote access to the macAddrClone endpoint by configuring firewall or ACL rules to allow only trusted internal networks.
  • If the device configuration permits, disable the macAddrClone feature or the associated API to remove the injection vector until a permanent fix is applied.
  • Continuously monitor system logs for anomalous command executions or repeated attempts to use the macAddrClone endpoint and set alerts for suspicious activity.

Generated by OpenCVE AI on April 18, 2026 at 19:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Ziroom
Ziroom zhome A0101
Vendors & Products Ziroom
Ziroom zhome A0101

Tue, 03 Feb 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Ziroom ZHOME A0101 1.0.1.0. This issue affects the function macAddrClone of the file luci\controller\api\zrMacClone.lua. The manipulation of the argument macType results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ziroom ZHOME A0101 zrMacClone.lua macAddrClone command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Ziroom Zhome A0101
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:15:04.936Z

Reserved: 2026-02-03T12:53:29.818Z

Link: CVE-2026-1802

cve-icon Vulnrichment

Updated: 2026-02-03T19:50:26.898Z

cve-icon NVD

Status : Deferred

Published: 2026-02-03T19:16:16.170

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-1802

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T20:00:09Z

Weaknesses