{"id":"CVE-2026-102793","published":"2026-09-30T00:16:33.743","lastModified":"2026-09-30T00:16:33.743","description":"A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://github.com/waltz-sketch/Ziroom/blob/main/set_time_zone_hostname_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-102793","tags":[]},{"url":"https://vuldb.com/submit/914649","tags":[]},{"url":"https://vuldb.com/submit/914650","tags":[]},{"url":"https://vuldb.com/vuln/411470","tags":[]},{"url":"https://vuldb.com/vuln/411470/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/waltz-sketch/Ziroom/blob/main/set_time_zone_hostname_command_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows remote command injection through the manipulation of the hostname/zonename argument in the set_time_zone function of Ziroom ZHOME A0101 1.0.1.0, enabling potential attackers to execute arbitrary commands on the system.","exploitability":"Exploitation is relatively straightforward given the remote access requirement and the presence of a published exploit.","blast_radius":"If exploited, this vulnerability could lead to complete system compromise, including data theft, service disruption, and unauthorized command execution.","remediation":"Upgrade to the specific version 1.0.1.1 or later as published by the vendor.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","remote","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T08:58:55.390Z"}}