CVE-2026-121260 in ZHOME A0101
Summary
by MITRE • 11/03/2026
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405 represents a critical security flaw within the device's embedded Linux environment, specifically targeting the Lua scripting engine used by the LuCI web interface framework. The core of this issue lies in the improper handling of input data passed to the loadstring function located in the usr/lib/lua/luci/controller/api/zrUsb.lua file. This component serves as a handler for USB-related API requests and is responsible for dynamically executing Lua code based on user-supplied parameters. Because the application fails to adequately sanitize or validate these inputs before passing them to the interpreter, it creates an opportunity for arbitrary code execution. The loadstring function in Lua compiles and executes strings as Lua chunks; when this input is not strictly controlled, attackers can inject malicious Lua scripts that are then executed with the privileges of the web server process running on the device.
This flaw is classified under CWE-94 Improper Control of Generation of Code or Script, commonly known as code injection. The technical mechanism involves an attacker sending a specially crafted HTTP request to the affected API endpoint. By manipulating specific parameters within this request, the adversary can inject Lua syntax that alters the intended logic of the zrUsb.lua script. Since LuCI typically runs with root privileges on embedded IoT devices to manage system configurations and hardware interfaces, successful exploitation grants the attacker full control over the underlying operating system. This is not merely a theoretical risk; an exploit has been publicly published, which significantly lowers the barrier for entry for malicious actors who may lack advanced reverse engineering skills but possess basic knowledge of web application attacks.
The operational impact of this vulnerability is severe due to its remote exploitable nature and the high privilege level associated with the compromised component. An unauthenticated attacker can leverage this flaw from a network position, potentially over LAN or via exposed internet services if port forwarding is configured incorrectly by users. Once code execution is achieved, the consequences extend beyond simple data theft. The attacker can install persistent backdoors, modify firmware settings to disable security features such as firewalls or encryption, exfiltrate sensitive user data stored on the device, or use the compromised smart home hub as a pivot point for lateral movement within the local network. This effectively turns a consumer IoT device into a botnet node or an entry point for broader infrastructure compromise.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059 which covers execution of scripts on compromised systems. The lack of vendor response further exacerbates the risk profile, as there are no official patches or firmware updates available to remediate the issue through standard update channels. This silence from Ziroom regarding this disclosure leaves users with limited options for defense beyond network-level controls.
Mitigation strategies must therefore focus heavily on architectural and network-based defenses since patching is not currently an option provided by the vendor. Users should isolate these devices in a separate VLAN or guest network segment to prevent lateral movement if exploitation occurs. It is critical to disable any remote management features that expose the LuCI interface or associated APIs to the public internet, ensuring they are only accessible from trusted internal networks where possible. Additionally, implementing strict firewall rules to block inbound traffic to ports typically used by LuCI and its API endpoints can reduce the attack surface significantly. For organizations managing fleets of these devices, network monitoring solutions should be configured to detect anomalous HTTP requests containing Lua syntax or unusual patterns in POST data directed at the zrUsb.lua endpoint. Until a vendor-supplied patch is released, reliance on perimeter security controls remains the primary defense against this critical code injection vulnerability.