Threats affecting pkg:github/wlz1112/ZHOME_A0101

CVE-2026-101187 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects the USB Device Management API function pop_usb_device in the file usr/lib/lua/luci/controller/api/zrUsb.lua. The vulnerability allows remote attackers to execute arbitrary commands by manipulating the argument path. Public exploit code is available, and the vendor has not responded to disclosure. No patch or remediation guidance is currently provided.