CVE-2026-101187: Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection
A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function popusbdevice of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is reachable remotely and has low attack complexity. However, the supplied vector indicates that the attacker needs high privileges before exploitation.
Is public exploit code available?
Yes. The exploit has been publicly disclosed and could be used in attacks.
Which deployments are known to be affected?
The affected product and version identified in the available information are Ziroom ZHOME A0101 1.0.1.0. The data does not establish whether other versions or configurations are affected.
Is a vendor fix available?
No vendor response is reported. The available information does not identify a patch or workaround.