A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0.

#!/usr/bin/env bash
# check_cve_2026_102794.sh — Detect CVE-2026-102794 (Ziroom ZHOME A0101 ping cmd injection)
# Usage: bash check_cve_2026_102794.sh <target_ip>
# Output: VULNERABLE / PATCHED / UNKNOWN
# Requires: curl, grep
# Does NOT exploit the vulnerability — only checks endpoint reachability and default creds.

set -euo pipefail

TARGET="${1:-192.168.18.1}"
PORT="${2:-80}"
BASE="http://${TARGET}:${PORT}"
RESULT="UNKNOWN"

echo "[*] CVE-2026-102794 checker for Ziroom ZHOME A0101"
echo "[*] Target: ${BASE}"

# Step 1: Check if the device is reachable
if ! curl -s -o /dev/null -w '' --connect-timeout 5 "${BASE}/" 2>/dev/null; then
    echo "[-] Target unreachable at ${BASE}"
    echo "UNKNOWN"
    exit 2
fi
echo "[+] Target is reachable"

# Step 2: Attempt login with default credentials
LOGIN_RESP=$(curl -s -D - -o /dev/null --connect-timeout 10 \
    -X POST "${BASE}/cgi-bin/luci" \
    -d "username=root&password=admin" \
    -L 2>/dev/null || true)

STOK=$(echo "${LOGIN_RESP}" | grep -oP 'stok=\K[^/;\r\n]+' | head -1 || true)
COOKIE=$(echo "${LOGIN_RESP}" | grep -i '^set-cookie:' | grep -oP 'sysauth=[^;]+' | head -1 || true)

if [ -z "${STOK}" ] || [ -z "${COOKIE}" ]; then
    echo "[-] Default credentials (root/admin) rejected or login endpoint differs"
    echo "[*] Device may exist but default creds changed — not directly exploitable"
    echo "UNKNOWN"
    exit 2
fi
echo "[!] Default credentials ACCEPTED — stok token obtained"

# Step 3: Check if the vulnerable endpoint exists (safe probe, no injection)
PING_RESP=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 10 \
    -X POST "${BASE}/cgi-bin/luci/;stok=${STOK}/api/ZRnetwork/ping" \
    -b "${COOKIE}" \
    --data-urlencode "url=127.0.0.1" 2>/dev/null || echo "000")

if [ "${PING_RESP}" = "200" ]; then
    echo "[!] /api/ZRnetwork/ping endpoint EXISTS and responds"
    echo "[!] Firmware is vulnerable to CVE-2026-102794 (no patch exists)"
    RESULT="VULNERABLE"
elif [ "${PING_RESP}" = "404" ] || [ "${PING_RESP}" = "403" ]; then
    echo "[+] /api/ZRnetwork/ping returned ${PING_RESP} — may be disabled"
    RESULT="PATCHED"
else
    echo "[?] Unexpected HTTP ${PING_RESP} from ping endpoint"
    RESULT="UNKNOWN"
fi

echo "${RESULT}"
case "${RESULT}" in
    VULNERABLE) exit 1 ;;
    PATCHED)    exit 0 ;;
    *)          exit 2 ;;
esac