rootpwn

critical · CVSS v3 9.1 · CVSS v4 9.4

CVE-2026-101263

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQ…

Description

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

Severity
critical
CVSS v2
8.3
CVSS v3
9.1
CVSS v4
9.4
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-101261

Ziroom ZHOME A0101 firmware 1.0.1.0 contains a command injection vulnerability in the /api/ZRnetwork/firstSetup_wifi endpoint. Remote attackers can supply a crafted login_pwd parameter to execute arbitrary commands. This flaw could allow full compromise of the device.

View analysis

critical

CVE-2026-101264

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-102361

Mall4j 4.0 has a missing authentication flaw in the PUT /user/updatePwd endpoint that lets unauthenticated users reset any storefront account password. This allows attackers to take over customer accounts and access sensitive order data. The vulnerability is critical with a CVSS v3 score of 9.1.

View analysis

critical

CVE-2026-101077

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis