CVE-2026-102794

Summary

This vulnerability allows for command injection through the manipulation of the 'url' argument in the '/api/ZRnetwork/ping' endpoint, leading to potential remote code execution.

Exploitability

Exploitation is relatively straightforward given the public disclosure of the exploit. The attacker needs to manipulate the 'url' argument to inject commands.

Blast radius

If exploited, this could lead to complete compromise of the affected system, including remote code execution and potential data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of Ziroom ZHOME A0101, specifically version 1.0.1.1 or later, as published by the vendor.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.