CVE-2026-101187
CriticalCVSS 9.1Summary
A weakness in Ziroom ZHOME A0101 version 1.0.1.0 affects the function pop_usb_device in the file usr/lib/lua/luci/controller/api/zrUsb.lua of the USB Device Management API component. Manipulation of the argument path causes command injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
The risk includes remote command execution, which could allow an attacker to take control of the device and access connected USB devices.
Recommendation
It is recommended to update the device firmware if a patch is available, and to restrict access to the USB API to trusted users only.
Other vulnerabilities in Ziroom ZHOME A0101
See all- CVE-2026-101262Critical
A vulnerability in Ziroom ZHOME A0101 version 1.0.1.0 affects unknown code in the file /api/ZRQos/set_online_client. Manipulation of the argument ip leads to command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-101261Critical
A flaw in Ziroom ZHOME A0101 version 1.0.1.0 affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Manipulation of the argument login_pwd leads to command injection. The attack can be performed remotely, and the exploit is published.
- CVE-2026-101260Critical
A vulnerability was detected in Ziroom ZHOME A0101 version 1.0.1.0, affecting unknown functionality of the file /api/ZRnetwork/firstLogin. Manipulation of the argument firstLogin results in command injection. The attack can be performed remotely, and the exploit is public.
Original NVD description (English source)
A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS