CVE-2026-1802

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in Ziroom ZHOME A0101 1.0.1.0. This issue affects the function macAddrClone of the file luci\controller\api\zrMacClone.lua. The manipulation of the argument macType results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-180205.3IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.CVE-2026-180216.5The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in a CVE-2026-180228.8Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to a CVE-2026-180235.7Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive informatio CVE-2026-180244.3Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a cr CVE-2026-180276.5The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Trav CVE-2026-180282.3The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a f CVE-2026-180296.3Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment s CVE-2026-18038.1A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This ma CVE-2026-180308.1The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted th CVE-2026-180319.8The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account asso CVE-2026-180327.5The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions,