Reported by 2 outlets
Ziroom ZHOME A0101 critical command injection CVE-2026-101264 (CVSS 9.4)
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 4.90 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Ziroom ZHOME A0101 v1.0.1.0 has a critical command injection vulnerability (CVE-2026-101264, CVSS 9.4) in /api/ZRnetwork/set_passwd and a second critical injection (CVE-2026-102794) via /api/ZRnetwork/ping URL parameter. Radar reports that public exploit code is available. No patch is confirmed for either flaw. The device is exposed to full remote command execution through these endpoints. Monitor for vendor patches, active exploitation reports, and any CISA or national CERT advisories.
Timeline
-
original reporting
Ziroom ZHOME A0101 v1.0.1.0 faces a CRITICAL (CVSS 9.4) command injection flaw (CVE-2026-101264) via /api/ZRnetwork/set_passwd. No patch, ve
radar.offseq.com · 15d ago · September 29th, 2026
Ziroom ZHOME A0101 v1.0.1.0 faces a CRITICAL (CVSS 9.4) command injection flaw (CVE-2026-101264) via /api/ZRnetwork/set_passwd. No patch, ve
via Mastodon https://radar.offseq.com/threat/cve-2026-101264-command-injection-in-ziroom-zhome-a0101-06a3a86bcb9501aa
-
update from euvd.enisa.europa.eu
🚨 EUVD-2026-88572 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: ZHOME A0101 🏢 Vendor: Ziroom 📅 Updated: 2026-09-28 📝 A vulnerability was determined
euvd.enisa.europa.eu · 15d ago · September 29th, 2026
🚨 EUVD-2026-88572 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: ZHOME A0101 🏢 Vendor: Ziroom 📅 Updated: 2026-09-28 📝 A vulnerability was determined
via Mastodon https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88572
-
mentioned by euvd.enisa.europa.eu
🚨 EUVD-2026-88571 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: ZHOME A0101 🏢 Vendor: Ziroom 📅 Updated: 2026-09-28 📝 A vulnerability was found in Z
euvd.enisa.europa.eu · 15d ago · September 29th, 2026
-
mentioned by euvd.enisa.europa.eu
🚨 EUVD-2026-88570 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: ZHOME A0101 🏢 Vendor: Ziroom 📅 Updated: 2026-09-28 📝 A vulnerability has been found
euvd.enisa.europa.eu · 15d ago · September 29th, 2026
-
mentioned by euvd.enisa.europa.eu
🚨 EUVD-2026-88569 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: ZHOME A0101 🏢 Vendor: Ziroom 📅 Updated: 2026-09-28 📝 A flaw has been found in Ziroo
euvd.enisa.europa.eu · 15d ago · September 29th, 2026
-
update from radar.offseq.com
CVE-2026-102794: Ziroom ZHOME A0101 v1.0.1.0 has a CRITICAL command injection vuln in /api/ZRnetwork/ping (url param). Public exploit availa
radar.offseq.com · 14d ago · September 30th, 2026
CVE-2026-102794: Ziroom ZHOME A0101 v1.0.1.0 has a CRITICAL command injection vuln in /api/ZRnetwork/ping (url param).
-
mentioned by radar.offseq.com
CVE-2026-102794: Ziroom ZHOME A0101 v1.0.1.0 is affected by a CRITICAL command injection flaw (CVSS 9.1) in /api/ZRnetwork/ping. No patch, p
radar.offseq.com · 14d ago · September 30th, 2026