CVE-2026-101263
CriticalCVSS 9.1Summary
A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0 in some unknown processing of the /api/ZRQos/set_online_client file. Manipulation of the mac argument results in command injection. The attack can be launched remotely and the exploit has been made public.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, potentially leading to full compromise and network integrity issues.
Recommendation
Update the device firmware if a patch is available, and monitor network traffic for suspicious API requests.
Other vulnerabilities in Ziroom ZHOME A0101
See all- CVE-2026-101264Critical
A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0 in an unknown function of the /api/ZRnetwork/set_passwd file. Manipulation of the password1 argument causes command injection. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-101262Critical
A vulnerability in Ziroom ZHOME A0101 version 1.0.1.0 affects unknown code in the file /api/ZRQos/set_online_client. Manipulation of the argument ip leads to command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-101261Critical
A flaw in Ziroom ZHOME A0101 version 1.0.1.0 affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Manipulation of the argument login_pwd leads to command injection. The attack can be performed remotely, and the exploit is published.
- CVE-2026-101260Critical
A vulnerability was detected in Ziroom ZHOME A0101 version 1.0.1.0, affecting unknown functionality of the file /api/ZRnetwork/firstLogin. Manipulation of the argument firstLogin results in command injection. The attack can be performed remotely, and the exploit is public.
- CVE-2026-101187Critical
A weakness in Ziroom ZHOME A0101 version 1.0.1.0 affects the function pop_usb_device in the file usr/lib/lua/luci/controller/api/zrUsb.lua of the USB Device Management API component. Manipulation of the argument path causes command injection. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS