CVE-2026-121260

Summary

A code injection vulnerability exists in the Lua handler function loadstring within the Ziroom ZHOME A0101 firmware (version 1.0.1.0 Build 202004151405), allowing remote attackers with high privileges to execute arbitrary Lua code via crafted input.

Exploitability

Exploitation requires high-privilege access (PR:H) and no user interaction, but the exploit is publicly available, lowering the barrier for less-skilled attackers.

Blast radius

Successful exploitation leads to full compromise of confidentiality, integrity, and availability on the affected device, potentially enabling complete control of the smart home gateway or connected IoT devices.

Detection

Monitor for HTTP POST requests to /cgi-bin/luci/api/zrUsb containing suspicious Lua code patterns (e.g., loadstring, os.execute, io.popen) in the request body; also watch for unexpected child processes spawned by the luasrc or luci services on the device.

Prioritized remediation

Upgrade to a patched firmware version released after the vendor's acknowledgment of this flaw; since no fixed version is specified in the description and the vendor did not respond, disable the Lua controller endpoint /cgi-bin/luci/api/zrUsb or restrict access to it via network segmentation until an official patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.