Which versions of Ziroom ZHOME A0101 are affected by CVE-2026-101262?

The Ziroom ZHOME A0101 smart-home gateway (firmware 1.0.1.0) contains a command injection vulnerability that allows an attacker with administrative access to execute arbitrary shell commands,…

Is there a public PoC exploit available for CVE-2026-101262?

Yes, a public proof-of-concept exploit is available for CVE-2026-101262. Prioritise patching immediately. EPSS: 2.4%.

How to fix or mitigate CVE-2026-101262?

Within 24 hours, identify all instances of Ziroom ZHOME A0101 firmware 1.0.1.0 and restrict network access to the administrative interface to trusted IPs only; change all default administrative credentials and enable multi-factor authentication if supported. Within 7 days, implement network segmentation to isolate the gateways from critical systems, deploy intrusion detection/prevention signatures to block exploitation attempts against the /api/ZRQos/set_online_client endpoint, and monitor logs for anomalous command execution. Within 30 days, engage with Ziroom for a patched firmware, evaluate replacement gateways from alternative vendors, and consider disabling the vulnerable endpoint via configuration if possible; if no patch is provided, plan for decommissioning of affected devices.

Ziroom ZHOME A0101 CVE-2026-101262

Q: What is the CVSS score of CVE-2026-101262?

CVE-2026-101262 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.4%.

EUVD-2026-88570 HIGH

Command Injection (CWE-77)

2026-09-28 VulDB

GHSA-6x7m-fmhh-589c

Command Injection Zhome A0101

8.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable API with low complexity; PR:H reflects VulDB's authenticated-privilege prerequisite; command injection yields full OS command execution so C/I/A:H, scope unchanged as impact stays on the device.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 28, 2026 - 23:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 28, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Sep 28, 2026 - 23:22 NVD

CRITICAL HIGH

CVSS changed

Sep 28, 2026 - 23:22 NVD

9.4 (CRITICAL) 8.5 (HIGH)

POC Analysis Generated

Sep 28, 2026 - 23:20 vuln.today

Analysis Generated

Sep 28, 2026 - 23:15 vuln.today

CVE Published

Sep 28, 2026 - 22:45 cve.org

CRITICAL 9.4

DescriptionCVE.org

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in the Ziroom ZHOME A0101 smart-home gateway (firmware 1.0.1.0) lets an attacker who already holds an administrative session execute arbitrary shell commands via the 'ip' argument of the /api/ZRQos/set_online_client endpoint, delivering high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, but exploitation is gated by the high privileges required (CVSS 4.0 PR:H) to reach the endpoint remotely over the network with no user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires reaching the device's HTTP API endpoint /api/ZRQos/set_online_client and supplying a crafted 'ip' argument with shell metacharacters. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a CWE-77 command injection in the /api/ZRQos/set_online_client endpoint of the Ziroom ZHOME A0101 smart-home gateway, injecting via the 'ip' argument. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis: Ziroom was contacted about the disclosure but did not respond, and no fixed firmware version is documented in the available references. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all instances of Ziroom ZHOME A0101 firmware 1.0.1.0 and restrict network access to the administrative interface to trusted IPs only; change all default administrative credentials and enable multi-factor authentication if supported. …

Threat intelligence, references, and detailed analysis are available after sign-in.