CVE-2026-101261

Summary

The flaw allows command injection via manipulation of the login_pwd argument in the /api/ZRnetwork/firstSetup_wifi endpoint, enabling remote attackers to execute arbitrary commands.

Exploitability

Exploitation is relatively straightforward from a remote location, requiring only manipulation of the login_pwd argument.

Blast radius

If exploited, this flaw could lead to complete control over the affected system, including data exfiltration, lateral movement, and further exploitation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected /api/ZRnetwork/firstSetup_wifi endpoint or restrict access to it.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.