CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-101187 — A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability...

·Source: NIST NVD

Updated:

Executive Summary

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used f

Analysis

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 9.1. Published: 2026-09-28T21:17:12.810.

Indicators of Compromise (2)

CVE (1)
CVE-2026-101187
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Malicious Linux Implants Mimic Asian Mail Security Products

A trio of newly discovered backdoors walk and quack like legitimate edge solutions, so it's hard to tell they're not.

Dark Reading
MEDIUMVulnerabilityNEW

Dell asks admins to patch max severity CSM flaws as soon as possible

Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. [...]

BleepingComputer
LOWVulnerability

Crypto Scammers Hijack Microsoft’s Official X Account

Hackers used the account, which has 13 million followers, to amplify a Clippy-themed cryptocurrency account. The post Crypto Scammers Hijack Microsoft’s Official X Account appeared first on SecurityWeek .

SecurityWeek