Waltz

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set syslog of the file /api/ZRnetwork/set syslog. The manipulation of the argument conloglevel/log size results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Ziroom ZHOME A0101 version 1.0.1.0 **Description** A flaw in the `set time zone()` function within the '/api/ZRFirmware/set time zone' endpoint allows for remote command injection. This occurs through the manipulation of the `hostname/zonename` argument, enabling an attacker to execute arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/api/ZRFirmware/set time zone' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ziroom ZHOME A0101 version 1.0.1.0 **Description** Remote command injection is possible due to improper processing of the `url` argument within the '/api/ZRnetwork/ping' endpoint. This allows an attacker to execute arbitrary commands on the system remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `url` parameter in the '/api/ZRnetwork/ping' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Ziroom ZHOME A0101 version 1.0.1.0 **Description** Remote command injection is possible due to improper processing of the `/api/ZRQos/set online client` endpoint. An attacker can exploit this by manipulating the `mac` argument to execute arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `mac` parameter in the `/api/ZRQos/set online client` endpoint to minimize the risk of exploitation.

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Ziroom ZHOME A0101 version 1.0.1.0 **Description** A remote command injection issue exists in the `/api/ZRnetwork/set passwd` endpoint. This occurs when the `password1` argument is manipulated, allowing an attacker to execute arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `password1` parameter in the `/api/ZRnetwork/set passwd` endpoint until the issue is resolved.

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup wifi. Executing a manipulation of the argument login pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Ziroom ZHOME A0101 version 1.0.1.0 **Description** A command injection issue exists that allows remote attackers to execute arbitrary commands. The flaw is located in the `/api/ZRQos/set online client` endpoint, where improper handling of the `ip` argument enables the injection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `ip` parameter in the `/api/ZRQos/set online client` endpoint to minimize the risk of exploitation.