CVE-2026-102792: Ziroom ZHOME A0101 set_syslog command injection
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable, but the published vector indicates that the attacker requires high privileges. No user interaction is required.
Which inputs and interface should be prioritized for exposure review?
Review access to the /api/ZRnetwork/set_syslog endpoint, specifically requests that supply the conloglevel or log_size arguments to the set_syslog function. The affected version identified is 1.0.1.0.
Is exploitation likely to be practical?
A public exploit is available, and the vulnerability is rated critical with high impacts to confidentiality, integrity, and availability. The available information also states that the vendor did not respond to the disclosure contact.