EUVD-2026-89479
GHSA-m655-382j-6799
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable command injection with low complexity but requiring high-privilege authenticated API access (PR:H); full device OS compromise gives C/I/A:H, scope unchanged as no separate system is shown affected.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the argument conloglevel/log_size results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege authenticated access to the management API to execute arbitrary OS commands via the conloglevel and log_size arguments of the set_syslog function exposed at /api/ZRnetwork/set_syslog. The flaw is network-reachable and needs no user interaction, and publicly available exploit code exists (a GitHub write-up), so the practical risk is elevated wherever the device API is exposed or admin credentials are weak or default - the PR:H requirement is the main limiting factor, and the vendor was contacted early but did not respond. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching the device's /api/ZRnetwork/set_syslog endpoint and supplying attacker-controlled shell metacharacters in the conloglevel or log_size argument of the set_syslog function; the injected string is passed into an OS command. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-77 command injection in the set_syslog handler (/api/ZRnetwork/set_syslog) of the Ziroom ZHOME A0101 smart-home device, where the conloglevel/log_size arguments are passed to an OS command. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis: the vendor was contacted early about the disclosure but did not respond, so no fixed firmware version, advisory, or CVE-page vendor guidance exists - track the VulDB entry https://vuldb.com/vuln/411469 and the CVE record https://vuldb.com/cve/CVE-2026-102792 for any future vendor response. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Ziroom ZHOME A0101 hubs running firmware 1.0.1.0 and immediately remove them from public internet exposure; restrict management API access, especially /api/ZRnetwork/set_syslog, to trusted administrative networks; rotate all admin credentials away from default or weak passwords; review logs for suspicious set_syslog requests; and contact Ziroom for patch status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stem
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today