CVE-2026-1803

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1803", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-03T12:53:32.979Z", "datePublished": "2026-02-03T20:02:05.815Z", "dateUpdated": "2026-02-23T09:15:17.008Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:15:17.008Z"}, "title": "Ziroom ZHOME A0101 Dropbear SSH Service default credentials", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1392", "lang": "en", "description": "Use of Default Credentials"}]}], "affected": [{"vendor": "Ziroom", "product": "ZHOME A0101", "versions": [{"version": "1.0.1.0", "status": "affected"}], "modules": ["Dropbear SSH Service"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This manipulation causes use of default credentials. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "baseSeverity": "CRITICAL"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.1, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-03T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-04T14:32:36.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "xxyNB (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.343976", "name": "VDB-343976 | Ziroom ZHOME A0101 Dropbear SSH Service default credentials", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.343976", "name": "VDB-343976 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.745497", "name": "Submit #745497 | Ziroom Smart Ziroom Smart Gateway (ZH-A0101) ZH-A0101 1.0.1.0 Backdoor", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/?submit.745529", "name": "Submit #745529 | Ziroom Smart Smart Gateway ZH-A0101 ZH-A0101 1.0.1.0 Credentials Management (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Blackhole23-Lab/-/blob/main/vulns/ssh-backdoor.md", "tags": ["related"]}, {"url": "https://github.com/Blackhole23-Lab/-/blob/main/vulns/ssh-backdoor.md#proof-of-concept", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T20:26:35.737975Z", "id": "CVE-2026-1803", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T20:26:41.310Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1803", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-03T20:26:35.737975Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T20:26:38.334Z"}}], "cna": {"title": "Ziroom ZHOME A0101 Dropbear SSH Service default credentials", "credits": [{"lang": "en", "type": "reporter", "value": "xxyNB (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Ziroom", "modules": ["Dropbear SSH Service"], "product": "ZHOME A0101", "versions": [{"status": "affected", "version": "1.0.1.0"}]}], "timeline": [{"lang": "en", "time": "2026-02-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-03T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-04T14:32:36.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.343976", "name": "VDB-343976 | Ziroom ZHOME A0101 Dropbear SSH Service default credentials", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.343976", "name": "VDB-343976 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.745497", "name": "Submit #745497 | Ziroom Smart Ziroom Smart Gateway (ZH-A0101) ZH-A0101 1.0.1.0 Backdoor", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/?submit.745529", "name": "Submit #745529 | Ziroom Smart Smart Gateway ZH-A0101 ZH-A0101 1.0.1.0 Credentials Management (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Blackhole23-Lab/-/blob/main/vulns/ssh-backdoor.md", "tags": ["related"]}, {"url": "https://github.com/Blackhole23-Lab/-/blob/main/vulns/ssh-backdoor.md#proof-of-concept", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This manipulation causes use of default credentials. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1392", "description": "Use of Default Credentials"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:15:17.008Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1803", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:15:17.008Z", "dateReserved": "2026-02-03T12:53:32.979Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-03T20:02:05.815Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Dropbear SSH Service"], "product": "ZHOME A0101", "vendor": "Ziroom", "versions": [{"status": "affected", "version": "1.0.1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This manipulation causes use of default credentials. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha identificado una debilidad en Ziroom ZHOME A0101 1.0.1.0. Afectada es una funci\u00f3n desconocida del componente Servicio SSH Dropbear. Esta manipulaci\u00f3n causa el uso de credenciales predeterminadas. La explotaci\u00f3n remota del ataque es posible. La complejidad de un ataque es bastante alta. La explotabilidad se considera dif\u00edcil. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser usado para ataques. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-1803", "lastModified": "2026-06-17T10:16:32.417", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.6, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1803", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T20:26:35.737975Z", "version": "2.0.3"}}]}, "published": "2026-02-03T20:15:57.973", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Blackhole23-Lab/-/blob/main/vulns/ssh-backdoor.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/Blackhole23-Lab/-/blob/main/vulns/ssh-backdoor.md#proof-of-concept"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.343976"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.343976"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.745497"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.745529"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1392"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:09:37.073649+00:00", "value": {"mitigation_remediation": ["Replace the default SSH credentials with unique, strong passwords or SSH key authentication.", "Apply any vendor\u2011supplied firmware or patch that eliminates the Dropbear flaw; if none is available, update the device to the latest secure firmware.", "Disable the Dropbear SSH service when it is not required for remote management.", "Segregate the device from untrusted networks or place it behind a firewall that only allows trusted management traffic."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via Default SSH Credentials"}, "threat_synthesis": {"affected_systems": "Ziroom ZHOME A0101 version 1.0.1.0 is the only product listed as vulnerable. No other versions or products are currently known to be affected.", "description_and_impact": "The ZHOME A0101 Dropbear SSH Service contains an unknown flaw that lets an attacker use the device\u2019s default credentials. It is inferred that once authenticated, the attacker could gain unrestricted remote command execution on the device, based on the nature of the default credential issue. The weakness is categorized as accidental exposure of default authentication information (CWE-1392) and carries a CVSS score of 9.2, indicating severe impact on confidentiality, integrity, and availability.", "risk_and_exploitability": "The vulnerability\u2019s complexity is described as high, but the exploit has already been released publicly, making it technically achievable for skilled attackers. EPSS is below one percent, so the current probability of exploitation is low, and it is not listed in the CISA KEV catalog. It is inferred that the likely attack vector is remote over the network, since an attacker who can reach the device\u2019s SSH port can exploit the default credentials to gain full control."}}}}, "created": "2026-02-04T12:04:59.223626+00:00", "updated": "2026-04-18T14:15:04.133042+00:00", "vendors": ["ziroom", "ziroom$PRODUCT$zhome_a0101"]}