Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection
Remote attackers can take control of this device!
Summary
Ziroom ZHOME A0101 firmware 1.0.1.0 Build 202004151405 has a code injection flaw in its Lua handler that remote attackers can exploit. A public exploit exists, and the vendor did not respond to early disclosure.
What to do
No fixed version is named in the sources. The vendor did not respond to early disclosure, so check the vendor's update notices directly.
Update these devices now!
- Ziroom ZHOME A0101
Products and platforms
CVE IDs
Sources
Times
First published
First seen