{"id":"CVE-2026-121260","published":"2026-11-03T16:17:23.393","lastModified":"2026-11-03T17:18:07.907","description":"A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-121260","tags":[]},{"url":"https://vuldb.com/submit/1018328","tags":[]},{"url":"https://vuldb.com/vuln/430226","tags":[]},{"url":"https://vuldb.com/vuln/430226/cti","tags":[]},{"url":"https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md","tags":[]},{"url":"https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A code injection vulnerability exists in the Lua handler function loadstring within the Ziroom ZHOME A0101 firmware (version 1.0.1.0 Build 202004151405), allowing remote attackers with high privileges to execute arbitrary Lua code via crafted input.","exploitability":"Exploitation requires high-privilege access (PR:H) and no user interaction, but the exploit is publicly available, lowering the barrier for less-skilled attackers.","blast_radius":"Successful exploitation leads to full compromise of confidentiality, integrity, and availability on the affected device, potentially enabling complete control of the smart home gateway or connected IoT devices.","remediation":"Upgrade to a patched firmware version released after the vendor's acknowledgment of this flaw; since no fixed version is specified in the description and the vendor did not respond, disable the Lua controller endpoint /cgi-bin/luci/api/zrUsb or restrict access to it via network segmentation until an official patch is available.","detection":"Monitor for HTTP POST requests to /cgi-bin/luci/api/zrUsb containing suspicious Lua code patterns (e.g., loadstring, os.execute, io.popen) in the request body; also watch for unexpected child processes spawned by the luasrc or luci services on the device.","tags":["code-injection","lua","iot","firmware","web-api"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:55:19.141Z"}}