EUVD-2026-89505
GHSA-rwfq-3993-vxx5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API endpoint (AV:N/AC:L) but gated behind privileged access (PR:H); command injection yields full code execution on the single device with no scope change (S:U), so C/I/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
9DescriptionCVE.org
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated, privileged session (vendor vector PR:H) on the Ziroom ZHOME A0101 device to reach the /api/ZRFirmware/set_time_zone endpoint; the injection is triggered by placing shell metacharacters in the hostname or zonename argument of the set_time_zone function. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - Ziroom was contacted about the disclosure and did not respond, so there is no fixed firmware version to upgrade to and no vendor advisory to cite beyond the referenced VulDB records (https://vuldb.com/vuln/411470, https://vuldb.com/cve/CVE-2026-102793) and the public PoC (https://github.com/waltz-sketch/Ziroom/blob/main/set_time_zone_hostname_command_injection.md). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within the first 24 hours, inventory all Ziroom ZHOME A0101 units on the network and confirm which are running firmware 1.0.1.0, isolate them onto a dedicated VLAN with strict egress filtering, and disable or firewall the /api/ZRFirmware/set_time_zone endpoint at the network perimeter so it is not reachable from general-purpose user or guest segments; also rotate credentials for any high-privileged accounts that can authenticate to these devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stem
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today