# CVE-2026-121260: Ziroom ZHOME A0101 code injection in Lua handler

Source: https://junglewise.ai/threats/cve-2026-121260-a-flaw-has-been-found-in-ziroom-zhome-a0101-1-0-1-0-build  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121260 · Severity: critical · CVSS 9.1 · Published 2026-11-03

Ziroom's ZHOME A0101 smart home hub contains a code injection vulnerability in its USB management API endpoint. An attacker with HTTP Basic Authentication credentials can inject and execute arbitrary Lua code on the device, potentially gaining full control of the hub and any connected systems.

Technologies: [Ziroom ZHOME A0101](https://junglewise.ai/threats/technologies/zhome-a0101). Vendors: [Ziroom](https://junglewise.ai/threats/vendors/ziroom).

## Quick answers

**Is CVE-2026-121260 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121260 being exploited in the wild.

**How severe is CVE-2026-121260?** Critical severity, with a CVSS score of 9.1, published 3 November 2026.

**Which products and versions are affected?** Ziroom ZHOME A0101 1.0.1.0 Build 202004151405.

**Is there a fix for CVE-2026-121260?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121260 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-121260?** Check whether you run Ziroom ZHOME A0101 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection flaw exists in the loadstring() function within usr/lib/lua/luci/controller/api/zrUsb.lua that processes unsanitized input from the /api/ZRUsb/get_usb_result endpoint. The vulnerability requires valid HTTP Basic Auth credentials (root user) and control over temporary files (/tmp/run/usb_list_result or /tmp/run/old_usb_list_result) to execute arbitrary Lua code on the device.

## Affected products

- Ziroom ZHOME A0101 1.0.1.0 Build 202004151405

## Timeline

- 2026-11-03: disclosed

## References

- [https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md](https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md)
- [https://vuldb.com/cve/CVE-2026-121260](https://vuldb.com/cve/CVE-2026-121260)

## Related threats

- [Ziroom ZHOME A0101 command injection in /api/ZRnetwork/ping](https://junglewise.ai/threats/cve-2026-102794-a-vulnerability-has-been-found-in-ziroom-zhome-a0101-1-0-1-0)
- [Ziroom ZHOME A0101 command injection in set_time_zone](https://junglewise.ai/threats/cve-2026-102793-a-flaw-has-been-found-in-ziroom-zhome-a0101-1-0-1-0-this)
- [Ziroom ZHOME A0101 command injection in set_syslog](https://junglewise.ai/threats/cve-2026-102792-a-vulnerability-was-detected-in-ziroom-zhome-a0101-1-0-1-0-this)
- [Ziroom ZHOME A0101 command injection in password API](https://junglewise.ai/threats/cve-2026-101264-a-vulnerability-was-determined-in-ziroom-zhome-a0101-1-0-1-0)
- [Ziroom ZHOME A0101 command injection in /api/ZRQos/set_online_client](https://junglewise.ai/threats/cve-2026-101263-a-vulnerability-was-found-in-ziroom-zhome-a0101-1-0-1-0-this)