Zetlyn
GitHubGet started

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown...

zetlyn/cve-ghsa vulnerability ghsa GHSA-qr4w-cmjh-rw2w cve CVE-2026-102794 known 2026-09-30

https://github.com/advisories/GHSA-qr4w-cmjh-rw2w

Properties

cvss9.1
receipt
Source
GitHub advisories
Its words
9.1
Read by
field:cvss.score
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-102794",
  "cvss": {
    "score": 9.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.02362,
    "percentile": 0.83137
  },
  "ghsa_id": "GHSA-qr4w-cmjh-rw2w",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qr4w-cmjh-rw2w",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qr4w-cmjh-rw2w"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-102794"
    }
  ],
  "nvd_published_at": "2026-09-30T00:16:34Z",
  "published_at": "2026-09-30T00:32:31Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-102794",
    "https://github.com/waltz-sketch/Ziroom/blob/main/zrnetwork_ping_url_command_injection.md",
    "https://vuldb.com/cve/CVE-2026-102794",
    "https://vuldb.com/submit/914651",
    "https://vuldb.com/vuln/411471",
    "https://vuldb.com/vuln/411471/cti",
    "https://github.com/advisories/GHSA-qr4w-cmjh-rw2w"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown...",
  "type": "unreviewed",
  "updated_at": "2026-09-30T00:32:32Z",
  "url": "https://api.github.com/advisories/GHSA-qr4w-cmjh-rw2w",
  "vulnerabilities": [],
  "withdrawn_at": null
}
cweCWE-74
receipt
Source
GitHub advisories
Its words
CWE-74
Read by
field:cwes[].cwe_id
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-102794",
  "cvss": {
    "score": 9.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.02362,
    "percentile": 0.83137
  },
  "ghsa_id": "GHSA-qr4w-cmjh-rw2w",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qr4w-cmjh-rw2w",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qr4w-cmjh-rw2w"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-102794"
    }
  ],
  "nvd_published_at": "2026-09-30T00:16:34Z",
  "published_at": "2026-09-30T00:32:31Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-102794",
    "https://github.com/waltz-sketch/Ziroom/blob/main/zrnetwork_ping_url_command_injection.md",
    "https://vuldb.com/cve/CVE-2026-102794",
    "https://vuldb.com/submit/914651",
    "https://vuldb.com/vuln/411471",
    "https://vuldb.com/vuln/411471/cti",
    "https://github.com/advisories/GHSA-qr4w-cmjh-rw2w"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown...",
  "type": "unreviewed",
  "updated_at": "2026-09-30T00:32:32Z",
  "url": "https://api.github.com/advisories/GHSA-qr4w-cmjh-rw2w",
  "vulnerabilities": [],
  "withdrawn_at": null
}
severityhigh
From 7.0 to 8.9.
receipt
Source
GitHub advisories
Its words
high
Read by
field:severity
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-102794",
  "cvss": {
    "score": 9.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-74",
      "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
    }
  ],
  "description": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.02362,
    "percentile": 0.83137
  },
  "ghsa_id": "GHSA-qr4w-cmjh-rw2w",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qr4w-cmjh-rw2w",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qr4w-cmjh-rw2w"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-102794"
    }
  ],
  "nvd_published_at": "2026-09-30T00:16:34Z",
  "published_at": "2026-09-30T00:32:31Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-102794",
    "https://github.com/waltz-sketch/Ziroom/blob/main/zrnetwork_ping_url_command_injection.md",
    "https://vuldb.com/cve/CVE-2026-102794",
    "https://vuldb.com/submit/914651",
    "https://vuldb.com/vuln/411471",
    "https://vuldb.com/vuln/411471/cti",
    "https://github.com/advisories/GHSA-qr4w-cmjh-rw2w"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown...",
  "type": "unreviewed",
  "updated_at": "2026-09-30T00:32:32Z",
  "url": "https://api.github.com/advisories/GHSA-qr4w-cmjh-rw2w",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown... A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.