CVE-2026-102793
HIGH
8,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
CRITICAL
9,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
HIGH
8,3
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: multiple
Confidentiality: complete
Integrity: complete
Availability: complete
Description
AI Translation Available
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Access Control
Other
Integrity
Non-Repudiation
Potential Impacts:
Read Application Data
Bypass Protection Mechanism
Alter Execution Logic
Other
Hide Activities
Applicable Platforms
All platforms may be affected
77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
DraftCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
AI/ML
https://github.com/waltz-sketch/Ziroom/blob/main/set_time_zone_hostname_command…
https://vuldb.com/cve/CVE-2026-102793
https://vuldb.com/submit/914649
https://vuldb.com/submit/914650
https://vuldb.com/vuln/411470
https://vuldb.com/vuln/411470/cti