---
id: CVE-2026-121260
title: Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection
summary: >-
  A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This
  issue affects the function loadstring of the file
  usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This
  manipulation causes code injectio…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-94
  - CWE-74
vendor: Ziroom
product: ZHOME A0101
affected:
  - zhome_a0101 1.0.1.0 Build 202004151405
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T16:36:45.500361Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T16:37:43.001Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121260'
references:
  - url: 'https://vuldb.com/vuln/430226'
    label: VDB-430226 | Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection
  - url: 'https://vuldb.com/vuln/430226/cti'
    label: 'VDB-430226 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-121260'
    label: CVE-2026-121260 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1018328'
    label: >-
      Submit #1018328 | Ziroom ZHOME-A0101 1.0.1.0, Build 202004151405 Command
      Injection
  - url: >-
      https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md
tags:
  - cve.org
  - exploit-available
epss: 0.00856
epssPercentile: 0.58633
ingestedAt: '2026-11-05T20:33:06.286Z'
---

## Overview

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `zhome_a0101 1.0.1.0 Build 202004151405`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.