| 标题 | ZHOME ZHOME ZH-A0101 1.0.1.0 (Build 202004151405) Command Injection |
|---|
| 描述 | A command injection vulnerability exists in the ZHOME ZH-A0101 firmware version x.x.x.x within the mac_addr_clone API.
The vulnerable component is:
usr/lib/lua/luci/controller/api/zrMacClone.lua
The affected endpoint is:
POST /api/ZRMacClone/mac_addr_clone
The vulnerable parameter is:
macType
The issue is caused by unsafe concatenation of user-controlled input into an operating system command in the debug logging function:
logger(msg):
os.execute('echo " ' .. msg .. ' " >>' .. outlog)
Because the user-controlled macType parameter is written into a shell command executed by os.execute(), shell command substitution syntax can be interpreted by /bin/sh, resulting in arbitrary command execution with root privileges.
The vulnerability is reachable when the production debug flag is enabled:
local g_debug = true
Successful exploitation allows an authenticated attacker to execute arbitrary commands as root on the device.
Impact includes:
- Unauthorized modification of device files
- Exposure of sensitive information
- Complete compromise of the router operating environment
The vulnerability was verified on a physical ZHOME ZH-A0101 device running firmware version 1.0.1.0. |
|---|
| 来源 | ⚠️ https://github.com/Wlz1112/ZHOME_A0101/blob/main/mac_addr_clone_mactype_command_injection.md |
|---|
| 用户 | haimianbaobao (UID 94979) |
|---|
| 提交 | 2026-07-27 16時59分 (2 月前) |
|---|
| 管理 | 2026-09-26 15時34分 (2 months later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 343975 [Ziroom ZHOME A0101 1.0.1.0 zrMacClone.lua macAddrClone macType 权限提升] |
|---|
| 积分 | 0 |
|---|