PT-2026-102358 · Ziroom · Zhome A0101
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ziroom ZHOME A0101 version 1.0.1.0
Description
An issue exists in the USB Device Management API within the file
usr/lib/lua/luci/controller/api/zrUsb.lua. A remote attacker can perform command injection by manipulating the path argument passed to the pop usb device() function. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device.Recommendations
For version 1.0.1.0, restrict access to the
pop usb device() function within the USB Device Management API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Command Injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zhome A0101