Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 set_syslog command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the argument conloglevel/log_size results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-102792

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102792

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102792
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #7896 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:52:21 GMT
Publisher date: Tue, 29 Sep 2026 22:45:16 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 set_time_zone command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-102793

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102793

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102793
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #5651 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:12:28 GMT
Publisher date: Tue, 29 Sep 2026 23:15:16 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 set_passwd command injection

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-101264

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-101264

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-101264
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #5391 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:07:32 GMT
Publisher date: Mon, 28 Sep 2026 23:15:14 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 firstSetup_wifi command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-101261

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-101261

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-101261
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #5390 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:07:31 GMT
Publisher date: Mon, 28 Sep 2026 22:30:13 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-102794

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102794

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102794
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #4378 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:50:58 GMT
Publisher date: Tue, 29 Sep 2026 23:30:10 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 firstLogin command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-101260

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-101260

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-101260
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #3991 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:44:43 GMT
Publisher date: Mon, 28 Sep 2026 22:15:10 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-101187

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-101187

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-101187
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #3958 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:29 GMT
Publisher date: Mon, 28 Sep 2026 20:45:07 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 set_online_client command injection

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-101263

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-101263

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-101263
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #3944 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:21 GMT
Publisher date: Mon, 28 Sep 2026 23:00:14 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Ziroom ZHOME A0101 set_online_client command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

ZHOME A0101 CVE-2026-101262

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-101262

ZHOME A0101

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-101262
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #3442 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:35:36 GMT
Publisher date: Mon, 28 Sep 2026 22:45:12 GMT

Read the original announcement