| Título | ZHOME ZHOME ZH-A0101 1.0.1.0 (Build 202004151405) Command Injection |
|---|
| Descrição | A command injection vulnerability exists in the ZHOME ZH-A0101 firmware version x.x.x.x within the mac_addr_clone API.
The vulnerable component is:
usr/lib/lua/luci/controller/api/zrMacClone.lua
The affected endpoint is:
POST /api/ZRMacClone/mac_addr_clone
The vulnerable parameter is:
macType
The issue is caused by unsafe concatenation of user-controlled input into an operating system command in the debug logging function:
logger(msg):
os.execute('echo " ' .. msg .. ' " >>' .. outlog)
Because the user-controlled macType parameter is written into a shell command executed by os.execute(), shell command substitution syntax can be interpreted by /bin/sh, resulting in arbitrary command execution with root privileges.
The vulnerability is reachable when the production debug flag is enabled:
local g_debug = true
Successful exploitation allows an authenticated attacker to execute arbitrary commands as root on the device.
Impact includes:
- Unauthorized modification of device files
- Exposure of sensitive information
- Complete compromise of the router operating environment
The vulnerability was verified on a physical ZHOME ZH-A0101 device running firmware version 1.0.1.0. |
|---|
| Fonte | ⚠️ https://github.com/Wlz1112/ZHOME_A0101/blob/main/mac_addr_clone_mactype_command_injection.md |
|---|
| Utilizador | haimianbaobao (UID 94979) |
|---|
| Submissão | 27/07/2026 16h59 (há 2 meses) |
|---|
| Moderação | 26/09/2026 15h34 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 343975 [Ziroom ZHOME A0101 1.0.1.0 zrMacClone.lua macAddrClone macType Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|