CVE-2026-102793

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0

Description A flaw in the set time zone() function within the '/api/ZRFirmware/set time zone' endpoint allows for remote command injection. This occurs through the manipulation of the hostname/zonename argument, enabling an attacker to execute arbitrary commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/api/ZRFirmware/set time zone' endpoint to minimize the risk of exploitation.