Ziroom ZHOME A0101: Code injection in Lua Handler (CVE-2026-121260)
A flaw in the Lua Handler of Ziroom ZHOME A0101 1.0.1.0 Build 202004151405 allows remote code injection via the loadstring function.
CVE search metadata
CVE search record: CVE-2026-121260. Severity: critical. CVSS: 9.1. KEV: no. Product: ZHOME A0101 (1.0.1.0 Build 202004151405). Brief: Ziroom ZHOME A0101: Code injection in Lua Handler (CVE-2026-121260). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ziroom-zhome-rce/
Triage facts
Revision 1- Applicability
- ZHOME A0101 (1.0.1.0 Build 202004151405)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 18:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A flaw has been identified in the loadstring function of the file usr/lib/lua/luci/controller/api/zrUsb.lua within the Lua Handler component of Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This manipulation results in code injection. The vulnerability is remotely exploitable, and public exploit code is available. The vendor was contacted but did not respond.