CVE-2026-101262: Ziroom ZHOME A0101 set_online_client command injection
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/setonlineclient. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability can be initiated remotely, but the CVSS vector indicates that high privileges are required. Exploitation involves manipulating the ip argument sent to the affected API endpoint.
Which deployment should be treated as affected?
Ziroom ZHOME A0101 version 1.0.1.0 is identified as affected. The vulnerable functionality is associated with the /api/ZRQos/set_online_client endpoint.
Is exploit code or active exploitation information available?
The exploit has been publicly disclosed and may be used. The provided data does not state whether exploitation has been observed in the wild.
Is a vendor fix or response available?
No vendor response is reported: the vendor was contacted early about the disclosure but did not respond. The provided information does not identify a fixed version or workaround.