CVE-2026-101264

EUVD-2026-88572
A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 82.92%
Common Weakness Enumeration
References
https://github.com/waltz-sketch/Ziroom/blob/main/set_passwd_password1_command_injection.md
https://vuldb.com/cve/CVE-2026-101264
https://vuldb.com/submit/914646
https://vuldb.com/vuln/411032
https://vuldb.com/vuln/411032/cti