The ZHOME A0101 Dropbear SSH Service contains an unknown flaw that lets an attacker use the device’s default credentials. It is inferred that once authenticated, the attacker could gain unrestricted remote command execution on the device, based on the nature of the default credential issue. The weakness is categorized as accidental exposure of default authentication information (CWE-1392) and carries a CVSS score of 9.2, indicating severe impact on confidentiality, integrity, and availability.

Ziroom ZHOME A0101 version 1.0.1.0 is the only product listed as vulnerable. No other versions or products are currently known to be affected.

The vulnerability’s complexity is described as high, but the exploit has already been released publicly, making it technically achievable for skilled attackers. EPSS is below one percent, so the current probability of exploitation is low, and it is not listed in the CISA KEV catalog. It is inferred that the likely attack vector is remote over the network, since an attacker who can reach the device’s SSH port can exploit the default credentials to gain full control.