| 标题 | ZHOME ZHOME ZH-A0101 1.0.1.0 (Build 202004151405) Command Injection |
|---|
| 描述 | A command injection vulnerability exists in the ZHOME ZH-A0101 firmware version x.x.x.x within the USB device management API.
The vulnerable component is:
usr/lib/lua/luci/controller/api/zrUsb.lua
The affected endpoint is:
POST /api/ZRUsb/pop_usb_device
The vulnerable parameter is:
path
The issue is caused by improper neutralization of user-controlled input when constructing shell commands.
The parameter "path" is directly concatenated into system commands:
/bin/mount | grep -w <path>
and:
umount -l <path>
The generated command is executed through LuciUtil.exec(), which invokes shell execution with root privileges.
Because the application does not validate or sanitize the supplied path value, an authenticated attacker can inject additional shell commands and execute arbitrary commands as root.
Impact includes:
- Complete compromise of the router operating environment
- Unauthorized modification of system files
- Exposure of sensitive configuration information
- Potential persistence after successful compromise
The vulnerability was verified on a physical ZHOME ZH-A0101 device running firmware version 1.0.1.0. |
|---|
| 来源 | ⚠️ https://github.com/Wlz1112/ZHOME_A0101/blob/main/pop_usb_device_path_command_injection.md |
|---|
| 用户 | haimianbaobao (UID 94979) |
|---|
| 提交 | 2026-07-27 17時00分 (2 月前) |
|---|
| 管理 | 2026-09-28 11時12分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 411008 [Ziroom ZHOME A0101 1.0.1.0 USB Device Management API zrUsb.lua pop_usb_device path 权限提升] |
|---|
| 积分 | 20 |
|---|