| शीर्षक | ZHOME ZHOME ZH-A0101 1.0.1.0 (Build 202004151405) Command Injection |
|---|
| विवरण | A command injection vulnerability exists in the ZHOME ZH-A0101 firmware version x.x.x.x within the mac_addr_clone API.
The vulnerable component is:
usr/lib/lua/luci/controller/api/zrMacClone.lua
The affected endpoint is:
POST /api/ZRMacClone/mac_addr_clone
The vulnerable parameter is:
macType
The issue is caused by unsafe concatenation of user-controlled input into an operating system command in the debug logging function:
logger(msg):
os.execute('echo " ' .. msg .. ' " >>' .. outlog)
Because the user-controlled macType parameter is written into a shell command executed by os.execute(), shell command substitution syntax can be interpreted by /bin/sh, resulting in arbitrary command execution with root privileges.
The vulnerability is reachable when the production debug flag is enabled:
local g_debug = true
Successful exploitation allows an authenticated attacker to execute arbitrary commands as root on the device.
Impact includes:
- Unauthorized modification of device files
- Exposure of sensitive information
- Complete compromise of the router operating environment
The vulnerability was verified on a physical ZHOME ZH-A0101 device running firmware version 1.0.1.0. |
|---|
| स्रोत | ⚠️ https://github.com/Wlz1112/ZHOME_A0101/blob/main/mac_addr_clone_mactype_command_injection.md |
|---|
| उपयोगकर्ता | haimianbaobao (UID 94979) |
|---|
| सबमिशन | 27/07/2026 04:59 PM (2 महीनों पहले) |
|---|
| संयम | 26/09/2026 03:34 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 343975 [Ziroom ZHOME A0101 1.0.1.0 zrMacClone.lua macAddrClone macType अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|