AI analysis
Claude Opus · 8 Nov 2026, 10:21 CET
Ziroom ZHOME A0101 code injection in USB Lua handler allows remote code execution
Ziroom ZHOME A0101 firmware 1.0.1.0 Build 202004151405 lets a remote attacker with high privileges inject code through a Lua USB handler. A public exploit reportedly exists and the vendor has not responded, so restrict access to the device's management interface.
In plain terms
The Ziroom ZHOME A0101 is a device whose web management interface is built on Lua, a scripting language. In firmware version 1.0.1.0 Build 202004151405, one part of that interface, the code that handles USB-related requests, can be tricked into running instructions an attacker supplies. This is called code injection: the device treats attacker input as program code and runs it.
The attacker needs administrator-level access to the device first. If they have it, they could take full control of the device and possibly use it to reach other systems on the same network. Owners and administrators of these devices should care, especially because the vendor has not responded to the report and no fix is listed.