{"id":"CVE-2026-121260","kind":"vulnerability","aliases":["CVE-2026-121260"],"related":[],"title":"Ziroom ZHOME A0101 router firmware: remote code injection via Lua handler","description":"A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Researcher write-up: StrToTable() in zrUsb.lua on Ziroom ZHOME A0101 firmware 1.0.1.0 Build 202004151405 passes the contents of /tmp/run/usb_list_result to loadstring(), so Lua code inside it runs when the authenticated GET /api/ZRUsb/get_usb_result is called. The attacker needs root login and a way to write that file, which the write-up gets from other ZHOME bugs or SSH. A public PoC exists. The vendor did not respond to disclosure and VulDB lists no countermeasure.","severity":"high","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ZHOME A0101","fixed":[],"affected":"1.0.1.0 Build 202004151405","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","infrastructure","iot","router-firmware","zhome-a0101","ziroom"],"not_affected_if":["auth-required","no-internet-exposure","other-firmware-versions"],"how_to_check":"- Check the router's firmware page for version 1.0.1.0 Build 202004151405 (Ziroom ZHOME A0101).\n- On a device you control, check whether usr/lib/lua/luci/controller/api/zrUsb.lua contains loadstring(\"return \" .. str) in StrToTable().\n- Check whether the web/API interface or SSH (the PoC uses port 1022) is reachable from outside the LAN, and whether the root password is still the default.","fix":"No fix: the vendor did not respond to disclosure and VulDB lists no countermeasure. Replace the device if possible; at minimum change the root password and keep the web interface and SSH off the internet.","status":"open","published_at":"2026-11-03T16:17:23+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:23:37+00:00","updated_at":"2026-11-03T16:24:27+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-03T16:23:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ziroom ZHOME A0101 router firmware: remote code injection via Lua handler","impact":"high","summary":"A flaw in the Lua handler zrUsb.lua of Ziroom ZHOME A0101 firmware 1.0.1.0 lets an attacker inject code through a loadstring call. The exploit is published, and the vendor did not respond to disclosure.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["ziroom","zhome-a0101","iot","router-firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the device remotely","analyst_note":"Confirm whether the zrUsb.lua endpoint requires authentication and whether a vendor or third-party fix exists; the NVD entry is the only source given.","how_to_check":"- Check whether the device runs Ziroom ZHOME A0101 firmware `1.0.1.0 Build 202004151405`\n- Look for the file `usr/lib/lua/luci/controller/api/zrUsb.lua` in the firmware image\n- Confirm whether the device's management interface is reachable from the internet","plain_action":"If you own a Ziroom ZHOME A0101 device, unplug it from the internet and wait for the manufacturer to publish a fix.","needs_analyst":true,"not_affected_if":["other-firmware-versions","no-internet-exposure"],"who_is_affected":"Devices running Ziroom ZHOME A0101 firmware 1.0.1.0 Build 202004151405, where the zrUsb.lua API handler is present. Exposure depends on whether the device's web or API interface can be reached remotely; the sources do not say which settings change that. Teams without this hardware can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000753,"input_tokens":4174,"output_tokens":672,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the zrUsb.lua endpoint requires authentication and whether a vendor or third-party fix exists; the NVD entry is the only source given.","search":"'-121260':14A,17A '-2026':13A,16A '/api/zrusb/get_usb_result':64B '/tmp/run/usb_list_result':51B '1.0.1.0':44B,116C '202004151405':46B,118C 'a0101':3A,19A,30B,42B,115C 'affect':121C 'attack':68B,143C 'auth':21B 'auth-requir':20B 'authent':62B 'bug':88B 'build':45B,117C 'call':66B 'caus':136C 'code':7A,56B,137C 'compon':131C 'contact':158C 'content':49B 'countermeasur':106B 'cve':12A,15A 'disclosur':101B,162C 'earli':159C 'exist':94B 'exploit':140C,147C 'file':78B,127C 'firmwar':5A,27B,43B 'flaw':108C 'found':111C 'function':123C 'get':63B,84B 'handler':11A,133C 'infrastructur':23B 'inject':8A,138C 'insid':57B 'iot':24B 'issu':120C 'list':104B 'loadstr':53B,124C 'login':71B 'lua':10A,55B,132C 'manipul':135C 'may':152C 'need':69B 'pass':47B 'poc':93B 'possibl':145C 'public':92B 'publish':150C 'remot':6A,139C 'requir':22B 'research':32B 'respond':99B,166C 'root':70B 'router':4A,26B 'router-firmwar':25B 'run':59B 'ssh':90B 'strtotabl':36B 'use':154C 'usr/lib/lua/luci/controller/api/zrusb.lua':128C 'vendor':96B,156C 'via':9A 'vuldb':103B 'way':74B,169C 'write':34B,76B,82B 'write-up':33B,81B 'zhome':2A,18A,29B,41B,87B,114C 'zhome-a0101':28B 'ziroom':1A,31B,40B,113C 'zrusb.lua':38B","nicknames":[],"mitigations":[],"who_affected":"Ziroom ZHOME A0101 routers on firmware 1.0.1.0 Build 202004151405. The write-up says the endpoint needs root authentication and that the attacker must also be able to write /tmp/run/usb_list_result, which it does through other ZHOME bugs or SSH. So this is a follow-on step after a device is already partly compromised, not a standalone unauthenticated hole. Anyone without this hardware can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Ziroom ZHOME A0101 device, unplug it from the internet and wait for the manufacturer to publish a fix.","pkeys":["a0101","zhomea0101"],"ptokens":["a0101","zhome"],"labels":["authrequired","high","infrastructure","iot","routerfirmware","zhomea0101","ziroom"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-121260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121260","severity":null,"published_at":"2026-11-03T16:17:23+00:00","modified_at":"2026-11-03T16:17:23+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121260:1502","url":null,"severity":null,"published_at":"2026-11-03T16:24:27+00:00","modified_at":"2026-11-03T16:24:27+00:00","first_seen_at":"2026-11-03T16:24:27+00:00","fetched_at":"2026-11-03T16:24:27+00:00","note":"Read VulDB VDB-430226 and researcher write-up (Wlz1112 repo). Endpoint requires root auth (PR:H) plus file write via another bug; triage's 'remote' framing is overstated, severity lowered critical->high. Fix none per VulDB (vendor silent), not verified (no vendor source). Sibling Ziroom CVEs: 101187 (pop_usb_device), 101260 (firstLogin) are the likely file-write chain. Plain action cleared: vendor states no action."}],"documents":[{"id":58872,"url":"https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md","title":"ZHOME A0101 zrUsb.lua loadstring code injection (researcher writeup + PoC)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":58873,"url":"https://vuldb.com/vuln/430226","title":"VDB-430226 Ziroom ZHOME A0101 zrUsb.lua loadstring code injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}