| tiêu đề | ZHOME ZHOME ZH-A0101 1.0.1.0 (Build 202004151405) Command Injection |
|---|
| Mô tả | A command injection vulnerability exists in the ZHOME ZH-A0101 firmware version x.x.x.x within the mac_addr_clone API.
The vulnerable component is:
usr/lib/lua/luci/controller/api/zrMacClone.lua
The affected endpoint is:
POST /api/ZRMacClone/mac_addr_clone
The vulnerable parameter is:
macType
The issue is caused by unsafe concatenation of user-controlled input into an operating system command in the debug logging function:
logger(msg):
os.execute('echo " ' .. msg .. ' " >>' .. outlog)
Because the user-controlled macType parameter is written into a shell command executed by os.execute(), shell command substitution syntax can be interpreted by /bin/sh, resulting in arbitrary command execution with root privileges.
The vulnerability is reachable when the production debug flag is enabled:
local g_debug = true
Successful exploitation allows an authenticated attacker to execute arbitrary commands as root on the device.
Impact includes:
- Unauthorized modification of device files
- Exposure of sensitive information
- Complete compromise of the router operating environment
The vulnerability was verified on a physical ZHOME ZH-A0101 device running firmware version 1.0.1.0. |
|---|
| Nguồn | ⚠️ https://github.com/Wlz1112/ZHOME_A0101/blob/main/mac_addr_clone_mactype_command_injection.md |
|---|
| Người dùng | haimianbaobao (UID 94979) |
|---|
| Đệ trình | 27/07/2026 16:59 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 26/09/2026 15:34 (2 months later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 343975 [Ziroom ZHOME A0101 1.0.1.0 zrMacClone.lua macAddrClone macType nâng cao đặc quyền] |
|---|
| điểm | 0 |
|---|