EUVD-2026-88571
GHSA-qh32-hcjf-q463
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable command injection with no user interaction; PR:H per vendor scoring reflects required high-privilege API access; OS command execution yields full C/I/A impact with no confirmed scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 allows an authenticated attacker with high privileges to execute arbitrary shell commands on the device by supplying a crafted 'mac' value to the /api/ZRQos/set_online_client API endpoint. The flaw is network-reachable (CVSS 3.1 AV:N/AC:L) and carries full confidentiality, integrity, and availability impact on both the vulnerable device and downstream systems, though the PR:H rating means the attacker must first hold administrative access to the ZHOME management interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching the device's API endpoint /api/ZRQos/set_online_client and supplying a malicious 'mac' argument with shell metacharacters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 8.5 (HIGH) reflects a network-reachable command-injection flaw (AV:N/AC:L) with full confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), tempered by a high-privilege requirement (PR:H) and E:P indicating proof-of-concept maturity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - Ziroom did not respond to the disclosure, so no fixed firmware version is available for ZHOME A0101 1.0.1.0, and users should not assume an update exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately restrict network access to the ZHOME management interface (firmware 1.0.1.0) to trusted administrative networks only, change all default or weak administrative credentials, and enable logging to monitor for requests to the /api/ZRQos/set_online_client endpoint with suspicious 'mac' values. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Zhome A0101
View allCommand injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
Command injection in the Ziroom ZHOME A0101 smart-home gateway (firmware 1.0.1.0) lets an attacker who already holds an
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the
Command injection in the Ziroom ZHOME A0101 smart home gateway (firmware 1.0.1.0) lets an authenticated, high-privileged
Remote command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) lets an attacker who can reach t
Command injection in the USB Device Management API (pop_usb_device) of the Ziroom ZHOME A0101 smart-home hub running fir
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today