| タイトル | ZHOME ZHOME ZH-A0101 1.0.1.0 (Build 202004151405) Command Injection |
|---|
| 説明 | A command injection vulnerability exists in the ZHOME ZH-A0101 firmware version x.x.x.x within the USB device management API.
The vulnerable component is:
usr/lib/lua/luci/controller/api/zrUsb.lua
The affected endpoint is:
POST /api/ZRUsb/pop_usb_device
The vulnerable parameter is:
path
The issue is caused by improper neutralization of user-controlled input when constructing shell commands.
The parameter "path" is directly concatenated into system commands:
/bin/mount | grep -w <path>
and:
umount -l <path>
The generated command is executed through LuciUtil.exec(), which invokes shell execution with root privileges.
Because the application does not validate or sanitize the supplied path value, an authenticated attacker can inject additional shell commands and execute arbitrary commands as root.
Impact includes:
- Complete compromise of the router operating environment
- Unauthorized modification of system files
- Exposure of sensitive configuration information
- Potential persistence after successful compromise
The vulnerability was verified on a physical ZHOME ZH-A0101 device running firmware version 1.0.1.0. |
|---|
| ソース | ⚠️ https://github.com/Wlz1112/ZHOME_A0101/blob/main/pop_usb_device_path_command_injection.md |
|---|
| ユーザー | haimianbaobao (UID 94979) |
|---|
| 送信 | 2026年07月27日 17:00 (2 月 ago) |
|---|
| モデレーション | 2026年09月28日 11:12 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 411008 [Ziroom ZHOME A0101 1.0.1.0 USB Device Management API zrUsb.lua pop_usb_device path 特権昇格] |
|---|
| ポイント | 20 |
|---|