Live › vulnerability › CVE-2026-121260
Researcher write-up: StrToTable() in zrUsb.lua on Ziroom ZHOME A0101 firmware 1.0.1.0 Build 202004151405 passes the contents of /tmp/run/usb_list_result to loadstring(), so Lua code inside it runs when the authenticated GET /api/ZRUsb/get_usb_result is called. The attacker needs root login and a way to write that file, which the write-up gets from other ZHOME bugs or SSH. A public PoC exists. The vendor did not respond to disclosure and VulDB lists no countermeasure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Ziroom ZHOME A0101 routers on firmware 1.0.1.0 Build 202004151405. The write-up says the endpoint needs root authentication and that the attacker must also be able to write /tmp/run/usb_list_result, which it does through other ZHOME bugs or SSH. So this is a follow-on step after a device is already partly compromised, not a standalone unauthenticated hole. Anyone without this hardware can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ZHOME A0101 | vendor | 1.0.1.0 Build 202004151405 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121260")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.