CVE-2026-101261

Received Received - Intake

Command Injection in Ziroom ZHOME A0101

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-101261

Affected Vendors & Products

Vendor	Product	Version / Range
ziroom	zhome	a0101

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in Ziroom ZHOME A0101 version 1.0.1.0. It exists in the /api/ZRnetwork/firstSetup_wifi endpoint where the login_pwd argument can be manipulated to execute arbitrary commands. The attack can be performed remotely and an exploit has been publicly disclosed.

Detection Guidance

Detecting this vulnerability requires checking for the presence of Ziroom ZHOME A0101 1.0.1.0 and testing the /api/ZRnetwork/firstSetup_wifi endpoint for command injection via the login_pwd parameter. Use network scanning tools like nmap to identify the device and curl to send a test payload to the vulnerable endpoint.

Impact Analysis

An attacker could exploit this to execute unauthorized commands on the affected system, potentially gaining control over the device or network. This could lead to data theft, system compromise, or further network infiltration depending on the device's role.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using this device may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Immediately restrict access to the /api/ZRnetwork/firstSetup_wifi endpoint, update or patch the Ziroom ZHOME software if an update is available, and monitor network traffic for suspicious activity targeting this endpoint. If no patch exists, consider isolating the device from critical systems.

Hi! I’m here to help you understand CVE-2026-101261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70