CVE-2026-101260

Received Received - Intake

Command Injection in Ziroom ZHOME A0101

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-101260

Affected Vendors & Products

Vendor	Product	Version / Range
ziroom	zhome	1.0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in Ziroom ZHOME A0101 version 1.0.1.0. It exists in the /api/ZRnetwork/firstLogin endpoint where manipulating the firstLogin argument allows remote attackers to execute arbitrary commands. The issue is exploitable over a network without requiring user interaction.

Detection Guidance

Detecting this vulnerability requires checking for command injection attempts targeting the /api/ZRnetwork/firstLogin endpoint in Ziroom ZHOME A0101 1.0.1.0. Monitor network traffic for suspicious payloads in the firstLogin parameter, such as commands like '; id', '| whoami', or '$(whoami)'. Inspect server logs for unusual activity or errors related to command execution.

Impact Analysis

An attacker could exploit this to run unauthorized commands on the affected system, potentially leading to full system compromise. This may allow data theft, installation of malware, or disruption of services. The public availability of the exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using the affected software may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update Ziroom ZHOME to the latest version if a patch is available. If no patch exists, disable or restrict access to the /api/ZRnetwork/firstLogin endpoint via firewall rules or network segmentation. Implement input validation to sanitize the firstLogin parameter and block special characters. Consider isolating affected systems until mitigation is complete.

Hi! I’m here to help you understand CVE-2026-101260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70