---
id: "CVE-2026-121260"
kind: "vulnerability"
aliases: ["CVE-2026-121260"]
title: "Ziroom ZHOME A0101 router firmware: remote code injection via Lua handler"
severity: "high"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ZHOME A0101", "fixed": [], "affected": "1.0.1.0 Build 202004151405", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "infrastructure", "iot", "router-firmware", "zhome-a0101", "ziroom"]
not_affected_if: ["auth-required", "no-internet-exposure", "other-firmware-versions"]
published_at: "2026-11-03T16:17:23+00:00"
first_seen_at: "2026-11-03T16:21:43+00:00"
updated_at: "2026-11-03T16:24:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121260", "first_seen_at": "2026-11-03T16:21:43+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T16:24:27+00:00"}]
---

# Ziroom ZHOME A0101 router firmware: remote code injection via Lua handler

Researcher write-up: StrToTable() in zrUsb.lua on Ziroom ZHOME A0101 firmware 1.0.1.0 Build 202004151405 passes the contents of /tmp/run/usb_list_result to loadstring(), so Lua code inside it runs when the authenticated GET /api/ZRUsb/get_usb_result is called. The attacker needs root login and a way to write that file, which the write-up gets from other ZHOME bugs or SSH. A public PoC exists. The vendor did not respond to disclosure and VulDB lists no countermeasure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ZHOME A0101 affected 1.0.1.0 Build 202004151405 fixed ?

## How to check

- Check the router's firmware page for version 1.0.1.0 Build 202004151405 (Ziroom ZHOME A0101).
- On a device you control, check whether usr/lib/lua/luci/controller/api/zrUsb.lua contains loadstring("return " .. str) in StrToTable().
- Check whether the web/API interface or SSH (the PoC uses port 1022) is reachable from outside the LAN, and whether the root password is still the default.

## Fix

No fix: the vendor did not respond to disclosure and VulDB lists no countermeasure. Replace the device if possible; at minimum change the root password and keep the web interface and SSH off the internet.

## Timeline

- 2026-11-03T16:21:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121260
- 2026-11-03T16:24:27+00:00 analyst — Read VulDB VDB-430226 and researcher write-up (Wlz1112 repo). Endpoint requires root auth (PR:H) plus file write via another bug; triage's 'remote' framing is overstated, severity lowered critical->high. Fix none per VulDB (vendor silent), not verified (no vendor source). Sibling Ziroom CVEs: 101187 (pop_usb_device), 101260 (firstLogin) are the likely file-write chain. Plain action cleared: vendor states no action.

## Documents

- [advisory] VDB-430226 Ziroom ZHOME A0101 zrUsb.lua loadstring code injection https://vuldb.com/vuln/430226
- [poc] ZHOME A0101 zrUsb.lua loadstring code injection (researcher writeup + PoC) https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md

## From the sources

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_