| 제목 | ZHOME ZHOME ZH-A0101 1.0.1.0 (Build 202004151405) Command Injection |
|---|
| 설명 | A command injection vulnerability exists in the ZHOME ZH-A0101 firmware version x.x.x.x within the mac_addr_clone API.
The vulnerable component is:
usr/lib/lua/luci/controller/api/zrMacClone.lua
The affected endpoint is:
POST /api/ZRMacClone/mac_addr_clone
The vulnerable parameter is:
macType
The issue is caused by unsafe concatenation of user-controlled input into an operating system command in the debug logging function:
logger(msg):
os.execute('echo " ' .. msg .. ' " >>' .. outlog)
Because the user-controlled macType parameter is written into a shell command executed by os.execute(), shell command substitution syntax can be interpreted by /bin/sh, resulting in arbitrary command execution with root privileges.
The vulnerability is reachable when the production debug flag is enabled:
local g_debug = true
Successful exploitation allows an authenticated attacker to execute arbitrary commands as root on the device.
Impact includes:
- Unauthorized modification of device files
- Exposure of sensitive information
- Complete compromise of the router operating environment
The vulnerability was verified on a physical ZHOME ZH-A0101 device running firmware version 1.0.1.0. |
|---|
| 원천 | ⚠️ https://github.com/Wlz1112/ZHOME_A0101/blob/main/mac_addr_clone_mactype_command_injection.md |
|---|
| 사용자 | haimianbaobao (UID 94979) |
|---|
| 제출 | 2026. 07. 27. PM 04:59 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 26. PM 03:34 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 343975 [Ziroom ZHOME A0101 1.0.1.0 zrMacClone.lua macAddrClone macType 권한 상승] |
|---|
| 포인트들 | 0 |
|---|