{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aziroomzhome_a0101/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-121260"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ZHOME A0101 (1.0.1.0 Build 202004151405)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Ziroom"],"content_html":"\u003cp\u003eA flaw has been identified in the \u003ccode\u003eloadstring\u003c/code\u003e function of the file \u003ccode\u003eusr/lib/lua/luci/controller/api/zrUsb.lua\u003c/code\u003e within the Lua Handler component of Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This manipulation results in code injection. The vulnerability is remotely exploitable, and public exploit code is available. The vendor was contacted but did not respond.\u003c/p\u003e\n","date_modified":"2026-11-03T18:02:33Z","date_published":"2026-11-03T18:02:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ziroom-zhome-rce/","summary":"A flaw in the Lua Handler of Ziroom ZHOME A0101 1.0.1.0 Build 202004151405 allows remote code injection via the loadstring function.","title":"Ziroom ZHOME A0101: Code injection in Lua Handler (CVE-2026-121260)","url":"https://feed.craftedsignal.io/briefs/2026-11-ziroom-zhome-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}