Zetlyn
GitHubGet started

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown...

zetlyn/cve-ghsa vulnerability ghsa GHSA-6x7m-fmhh-589c cve CVE-2026-101262 known 2026-09-29

https://github.com/advisories/GHSA-6x7m-fmhh-589c

Properties

cvss9.1
receipt
Source
GitHub advisories
Its words
9.1
Read by
field:cvss.score
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101262",
  "cvss": {
    "score": 9.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-6x7m-fmhh-589c",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6x7m-fmhh-589c",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6x7m-fmhh-589c"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101262"
    }
  ],
  "nvd_published_at": "2026-09-28T23:17:01Z",
  "published_at": "2026-09-29T00:31:38Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101262",
    "https://github.com/waltz-sketch/Ziroom/blob/main/set_online_client_ip_command_injection.md",
    "https://vuldb.com/cve/CVE-2026-101262",
    "https://vuldb.com/submit/914644",
    "https://vuldb.com/vuln/411030",
    "https://vuldb.com/vuln/411030/cti",
    "https://github.com/advisories/GHSA-6x7m-fmhh-589c"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown...",
  "type": "unreviewed",
  "updated_at": "2026-09-29T00:31:42Z",
  "url": "https://api.github.com/advisories/GHSA-6x7m-fmhh-589c",
  "vulnerabilities": [],
  "withdrawn_at": null
}
cweCWE-74
receipt
Source
GitHub advisories
Its words
CWE-74
Read by
field:cwes[].cwe_id
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101262",
  "cvss": {
    "score": 9.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-6x7m-fmhh-589c",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6x7m-fmhh-589c",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6x7m-fmhh-589c"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101262"
    }
  ],
  "nvd_published_at": "2026-09-28T23:17:01Z",
  "published_at": "2026-09-29T00:31:38Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101262",
    "https://github.com/waltz-sketch/Ziroom/blob/main/set_online_client_ip_command_injection.md",
    "https://vuldb.com/cve/CVE-2026-101262",
    "https://vuldb.com/submit/914644",
    "https://vuldb.com/vuln/411030",
    "https://vuldb.com/vuln/411030/cti",
    "https://github.com/advisories/GHSA-6x7m-fmhh-589c"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown...",
  "type": "unreviewed",
  "updated_at": "2026-09-29T00:31:42Z",
  "url": "https://api.github.com/advisories/GHSA-6x7m-fmhh-589c",
  "vulnerabilities": [],
  "withdrawn_at": null
}
severityhigh
From 7.0 to 8.9.
receipt
Source
GitHub advisories
Its words
high
Read by
field:severity
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101262",
  "cvss": {
    "score": 9.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-6x7m-fmhh-589c",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6x7m-fmhh-589c",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6x7m-fmhh-589c"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101262"
    }
  ],
  "nvd_published_at": "2026-09-28T23:17:01Z",
  "published_at": "2026-09-29T00:31:38Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101262",
    "https://github.com/waltz-sketch/Ziroom/blob/main/set_online_client_ip_command_injection.md",
    "https://vuldb.com/cve/CVE-2026-101262",
    "https://vuldb.com/submit/914644",
    "https://vuldb.com/vuln/411030",
    "https://vuldb.com/vuln/411030/cti",
    "https://github.com/advisories/GHSA-6x7m-fmhh-589c"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown...",
  "type": "unreviewed",
  "updated_at": "2026-09-29T00:31:42Z",
  "url": "https://api.github.com/advisories/GHSA-6x7m-fmhh-589c",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown... A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.