ZHOME A0101 CVE-2026-121260

Exploitation requires an authenticated session with high privileges (CVSS PR:H) on the ZHOME A0101 device, reaching the zrUsb API handler whose input is passed to the Lua loadstring function in usr/lib/lua/luci/controller/api/zrUsb.lua; that call compiling attacker-controlled data is the injection point. The attack is network-reachable (AV:N) and needs no user interaction (UI:N), and complexity is low (AC:L) once authenticated. Limiting factors: the PR:H requirement means an attacker must already possess administrative credentials or hijack an admin session, so risk is highest where the management interface is exposed to untrusted or multi-tenant users. No vendor fix is available because the vendor did not respond to disclosure.

The CVSS 4.0 base score of 8.5 (High) reflects a network-reachable (AV:N), low-complexity (AC:L) code-injection flaw with full confidentiality, integrity and availability impact on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H). The single most important mitigating signal is PR:H: exploitation requires high privileges, i.e. an already-authenticated administrative session on the device, which sharply narrows the realistic threat from 'any remote attacker' to 'an authenticated/insider or credential-compromised actor.' Exploit maturity is E:P (Proof-of-Concept), consistent with the input, which lists a GitHub PoC reference that is not verified as working exploit code. No CISA KEV listing and no EPSS score are present in the provided data, so there is no evidence of active exploitation or a quantified exploitation probability - the vuln.today decision label is 'this_week' rather than 'act_now'/'emergency.' The practical picture is a genuinely serious RCE primitive gated behind privileged access, with no vendor patch because the vendor did not respond to disclosure; prioritize it where the device exposes its management interface to untrusted users, but it is not a drop-everything unauthenticated internet-worm scenario given PR:H.

An attacker holding high-privilege (administrative) access to the ZHOME A0101 management interface sends a crafted request to the zrUsb API endpoint whose input is passed to the Lua loadstring function in zrUsb.lua, causing attacker-supplied Lua to be compiled and executed on the device. With AC:L the step is reliable once the attacker is authenticated, yielding code execution in the handler's context. A public PoC reference exists on GitHub; it is not verified as working exploit code.