CVE-2026-102794

{
  "etk_id": "ETK-2026-59",
  "cve_id": "CVE-2026-102794",
  "display_id": "CVE-2026-102794",
  "ghsa_id": "GHSA-qr4w-cmjh-rw2w",
  "euvd_id": "EUVD-2026-89534",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Command injection in Ziroom ZHOME A0101 ping API",
  "summary": "Ziroom ZHOME A0101 firmware 1.0.1.0 is affected by command injection in its ping API handling. An attacker with the required existing privileges may be able to execute commands remotely through the affected interface.",
  "mitigation": "Restrict access to the device management interface to trusted administrators and networks, and remove unnecessary remote exposure. Monitor for a vendor firmware update; no fixed version is recorded in the advisory.",
  "vendor": "Ziroom",
  "product": "ZHOME A0101",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ZHOME A0101",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0236,
  "epss_percentile": 0.8355,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 6.73280055,
  "t0_at": "2026-09-29T23:30:10.015000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-09-29T23:30:10.015000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-29T23:30:10.015000+00:00",
      "url": "https://github.com/waltz-sketch/Ziroom/blob/main/zrnetwork_ping_url_command_injection.md"
    },
    "trigger_signal": {
      "at": "2026-09-29T23:30:10.015000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-29T23:30:10.015000+00:00",
      "url": "https://github.com/advisories/GHSA-qr4w-cmjh-rw2w"
    }
  }
}