{"id":"CVE-2026-101261","published":"2026-09-28T23:17:01.003","lastModified":"2026-09-29T18:57:24.350","description":"A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://github.com/waltz-sketch/Ziroom/blob/main/firstsetup_wifi_login_pwd_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-101261","tags":[]},{"url":"https://vuldb.com/submit/914643","tags":[]},{"url":"https://vuldb.com/vuln/411029","tags":[]},{"url":"https://vuldb.com/vuln/411029/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/waltz-sketch/Ziroom/blob/main/firstsetup_wifi_login_pwd_command_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows command injection via manipulation of the login_pwd argument in the /api/ZRnetwork/firstSetup_wifi endpoint, enabling remote attackers to execute arbitrary commands.","exploitability":"Exploitation is relatively straightforward from a remote location, requiring only manipulation of the login_pwd argument.","blast_radius":"If exploited, this flaw could lead to complete control over the affected system, including data exfiltration, lateral movement, and further exploitation.","remediation":"Disable the affected /api/ZRnetwork/firstSetup_wifi endpoint or restrict access to it.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","command-injection"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T08:55:11.292Z"}}