Ziroom ZHOME A0101 CVE-2026-102794

Requires reaching the device's HTTP management API endpoint /api/ZRnetwork/ping and, per the vendor CVSS vector (PR:H), holding high-privilege/administrative authentication on the Ziroom ZHOME A0101 (firmware 1.0.1.0). The specific trigger is supplying shell metacharacters in the 'url' argument of the ping diagnostic function, which is passed to an OS command without sanitization. Exploitation is remote (AV:N) and needs no user interaction (UI:N), but is limited by the authentication prerequisite and by network reachability of the device's management interface, which is typically LAN-scoped for consumer smart-home hardware. No public patch is available since the vendor did not respond.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, all vulnerable-system impacts High) rates this 8.5, but the score is elevated by SC:H/SI:H/SA:H subsequent-system metrics that appear inflated - command injection on a single embedded gateway compromises that device, not a separate downstream system, so a scope change is not clearly justified. The most important limiter is PR:H: the vendor's own vector states high privileges are required, so an attacker must already hold administrative/authenticated access to the device's web API before reaching /api/ZRnetwork/ping. Working against risk-reduction, the reference set includes a public write-up (waltz-sketch/Ziroom GitHub) and the 4.0 vector carries E:P (Proof-of-Concept), and the description explicitly states the exploit has been disclosed publicly - so this is 'publicly available exploit code exists,' though NOT confirmed actively exploited. No EPSS score and no CISA KEV listing are present in the input; absence of KEV plus PR:H suggests this is not a mass-exploitation candidate but rather a device-takeover primitive for an attacker who already has admin credentials or has chained an auth bypass. The vendor did not respond to disclosure, so no official patch is confirmed available.

An attacker with administrative access to the ZHOME A0101 web management API sends a request to /api/ZRnetwork/ping with a crafted 'url' argument containing shell metacharacters, causing the device to execute arbitrary OS commands. A public proof-of-concept write-up exists on GitHub, lowering the effort to reproduce. Because the ping diagnostic passes the argument to a shell without sanitization, the attacker gains full command execution on the device.