EUVD-2026-88572
GHSA-xq84-qxfj-mw42
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote API endpoint (AV:N/AC:L) but requires high-privilege access to reach it (PR:H); OS command injection yields full device compromise (C/I/A:H), scope unchanged absent evidence of cross-system impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in the Ziroom ZHOME A0101 smart home gateway (firmware 1.0.1.0) lets an authenticated, high-privileged remote attacker execute arbitrary shell commands on the device via the password1 parameter of the /api/ZRnetwork/set_passwd endpoint. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H), and the high-privilege prerequisite (PR:H) is the key limiting factor, since an attacker must first hold elevated API access to reach the endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the /api/ZRnetwork/set_passwd endpoint of the Ziroom ZHOME A0101 (firmware 1.0.1.0) via a malicious payload in the password1 parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H) scores 8.5 and describes network-reachable command injection with high technical impact, but critically requires PR:H - high privileges must already be held to reach /api/ZRnetwork/set_passwd. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis, as the vendor did not respond to disclosure, so affected Ziroom ZHOME A0101 devices on firmware 1.0.1.0 cannot be fixed by a simple update and must be protected with compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Ziroom ZHOME A0101 smart home gateways running firmware 1.0.1.0, isolate them from untrusted networks, disable or strictly restrict remote access to the /api/ZRnetwork/set_passwd endpoint, ensure only necessary high-privileged accounts exist, and enable logging for command injection attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Zhome A0101
View allCommand injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
Command injection in the Ziroom ZHOME A0101 smart-home gateway (firmware 1.0.1.0) lets an attacker who already holds an
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the
Command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 allows an authenticated attacker with high privileges to execut
Remote command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) lets an attacker who can reach t
Command injection in the USB Device Management API (pop_usb_device) of the Ziroom ZHOME A0101 smart-home hub running fir
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today