Zhome A0101
Monthly
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. Publicly available exploit code exists (a PoC write-up on GitHub referenced by VulDB), the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege authenticated access to the management API to execute arbitrary OS commands via the conloglevel and log_size arguments of the set_syslog function exposed at /api/ZRnetwork/set_syslog. The flaw is network-reachable and needs no user interaction, and publicly available exploit code exists (a GitHub write-up), so the practical risk is elevated wherever the device API is exposed or admin credentials are weak or default - the PR:H requirement is the main limiting factor, and the vendor was contacted early but did not respond. No CISA KEV entry confirms active exploitation, and EPSS data was not provided.
Command injection in the Ziroom ZHOME A0101 smart home gateway (firmware 1.0.1.0) lets an authenticated, high-privileged remote attacker execute arbitrary shell commands on the device via the password1 parameter of the /api/ZRnetwork/set_passwd endpoint. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H), and the high-privilege prerequisite (PR:H) is the key limiting factor, since an attacker must first hold elevated API access to reach the endpoint. Publicly available exploit code exists for this exact endpoint, raising the practical risk, and because the vendor did not respond to disclosure there is no vendor-released patch; no confirmed active exploitation (CISA KEV) has been observed.
Command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 allows an authenticated attacker with high privileges to execute arbitrary shell commands on the device by supplying a crafted 'mac' value to the /api/ZRQos/set_online_client API endpoint. The flaw is network-reachable (CVSS 3.1 AV:N/AC:L) and carries full confidentiality, integrity, and availability impact on both the vulnerable device and downstream systems, though the PR:H rating means the attacker must first hold administrative access to the ZHOME management interface. Publicly available exploit code exists (a technical write-up is hosted on GitHub), but there is no indication of confirmed active exploitation, and the vendor has not released a fix.
Command injection in the Ziroom ZHOME A0101 smart-home gateway (firmware 1.0.1.0) lets an attacker who already holds an administrative session execute arbitrary shell commands via the 'ip' argument of the /api/ZRQos/set_online_client endpoint, delivering high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, but exploitation is gated by the high privileges required (CVSS 4.0 PR:H) to reach the endpoint remotely over the network with no user interaction. The vendor was contacted early about the disclosure and did not respond, so no patched firmware has been identified at time of analysis.
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the device's HTTP management API to execute arbitrary shell commands on the device by passing crafted shell metacharacters in the login_pwd argument of the /api/ZRnetwork/firstSetup_wifi endpoint. The vendor CVSS 4.0 vector (8.5, AV:N/AC:L/AT:N/PR:H/UI:N, with High confidentiality, integrity and availability impact plus changed scope) indicates that per the scoring model high privileges are required, although the independent assessment notes that because this is a first-time-provisioning endpoint the real privilege barrier may be weaker in practice and should be verified. Publicly available exploit code exists (a GitHub proof-of-concept), exploitation requires no user interaction, and no vendor patch is available because Ziroom did not respond to the disclosure.
Remote command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) lets an attacker who can reach the /api/ZRnetwork/firstLogin HTTP endpoint inject shell metacharacters through the 'firstLogin' parameter and execute arbitrary operating-system commands with the privileges of the underlying service. Publicly available exploit code exists (a proof-of-concept write-up is published on GitHub and the issue was reported via VulDB), and the vendor was contacted early but never responded, so no vendor patch is available. Scored 8.5 (CVSS 4.0 base, E:P) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H by our analysis; exploitation requires the device to be network-reachable, typically on a LAN or an exposed management interface.
Command injection in the USB Device Management API (pop_usb_device) of the Ziroom ZHOME A0101 smart-home hub running firmware 1.0.1.0 lets a remote attacker who already holds administrator credentials execute arbitrary operating-system commands on the device by manipulating the 'path' argument. Publicly available exploit code exists (published with a write-up, and a PoC linked by VulDB), but there is no indication of confirmed active exploitation (not in CISA KEV). The practical exposure is gated by the need for a valid high-privilege admin session against the hub's LuCI web interface, which tempers the high CVSS 4.0 base score of 8.5.
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. Publicly available exploit code exists (a PoC write-up on GitHub referenced by VulDB), the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege authenticated access to the management API to execute arbitrary OS commands via the conloglevel and log_size arguments of the set_syslog function exposed at /api/ZRnetwork/set_syslog. The flaw is network-reachable and needs no user interaction, and publicly available exploit code exists (a GitHub write-up), so the practical risk is elevated wherever the device API is exposed or admin credentials are weak or default - the PR:H requirement is the main limiting factor, and the vendor was contacted early but did not respond. No CISA KEV entry confirms active exploitation, and EPSS data was not provided.
Command injection in the Ziroom ZHOME A0101 smart home gateway (firmware 1.0.1.0) lets an authenticated, high-privileged remote attacker execute arbitrary shell commands on the device via the password1 parameter of the /api/ZRnetwork/set_passwd endpoint. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H), and the high-privilege prerequisite (PR:H) is the key limiting factor, since an attacker must first hold elevated API access to reach the endpoint. Publicly available exploit code exists for this exact endpoint, raising the practical risk, and because the vendor did not respond to disclosure there is no vendor-released patch; no confirmed active exploitation (CISA KEV) has been observed.
Command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 allows an authenticated attacker with high privileges to execute arbitrary shell commands on the device by supplying a crafted 'mac' value to the /api/ZRQos/set_online_client API endpoint. The flaw is network-reachable (CVSS 3.1 AV:N/AC:L) and carries full confidentiality, integrity, and availability impact on both the vulnerable device and downstream systems, though the PR:H rating means the attacker must first hold administrative access to the ZHOME management interface. Publicly available exploit code exists (a technical write-up is hosted on GitHub), but there is no indication of confirmed active exploitation, and the vendor has not released a fix.
Command injection in the Ziroom ZHOME A0101 smart-home gateway (firmware 1.0.1.0) lets an attacker who already holds an administrative session execute arbitrary shell commands via the 'ip' argument of the /api/ZRQos/set_online_client endpoint, delivering high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, but exploitation is gated by the high privileges required (CVSS 4.0 PR:H) to reach the endpoint remotely over the network with no user interaction. The vendor was contacted early about the disclosure and did not respond, so no patched firmware has been identified at time of analysis.
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the device's HTTP management API to execute arbitrary shell commands on the device by passing crafted shell metacharacters in the login_pwd argument of the /api/ZRnetwork/firstSetup_wifi endpoint. The vendor CVSS 4.0 vector (8.5, AV:N/AC:L/AT:N/PR:H/UI:N, with High confidentiality, integrity and availability impact plus changed scope) indicates that per the scoring model high privileges are required, although the independent assessment notes that because this is a first-time-provisioning endpoint the real privilege barrier may be weaker in practice and should be verified. Publicly available exploit code exists (a GitHub proof-of-concept), exploitation requires no user interaction, and no vendor patch is available because Ziroom did not respond to the disclosure.
Remote command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) lets an attacker who can reach the /api/ZRnetwork/firstLogin HTTP endpoint inject shell metacharacters through the 'firstLogin' parameter and execute arbitrary operating-system commands with the privileges of the underlying service. Publicly available exploit code exists (a proof-of-concept write-up is published on GitHub and the issue was reported via VulDB), and the vendor was contacted early but never responded, so no vendor patch is available. Scored 8.5 (CVSS 4.0 base, E:P) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H by our analysis; exploitation requires the device to be network-reachable, typically on a LAN or an exposed management interface.
Command injection in the USB Device Management API (pop_usb_device) of the Ziroom ZHOME A0101 smart-home hub running firmware 1.0.1.0 lets a remote attacker who already holds administrator credentials execute arbitrary operating-system commands on the device by manipulating the 'path' argument. Publicly available exploit code exists (published with a write-up, and a PoC linked by VulDB), but there is no indication of confirmed active exploitation (not in CISA KEV). The practical exposure is gated by the need for a valid high-privilege admin session against the hub's LuCI web interface, which tempers the high CVSS 4.0 base score of 8.5.