CVE-2026-101262

CriticalCVSS 9.1/10Last modified Sep 29, 2026

Description

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Sep 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1012639.1A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client CVE-2026-1012649.1A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This ma CVE-2026-1012653.1A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page CVE-2026-1012661.3A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.CVE-2026-1012672.7A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some spe CVE-2026-1012681.7If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the CVE-2026-1012692.3The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used CVE-2026-101276.3A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of th CVE-2026-1012702.1Malicious HTML content could be injected into the help texts of various fields with organizer permissions.CVE-2026-1012712.1OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is CVE-2026-1012769.2iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees s CVE-2026-1012776.5A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set o