A path‐manipulation flaw in Ziroom ZHOME A0101 version 1.0.1.0 allows an attacker to inject arbitrary shell commands by altering the path argument passed to the pop_usb_device API. The vulnerability resides in the pop_usb_device function located in usr/lib/lua/luci/controller/api/zrUsb.lua. By controlling the argument, the attacker can execute arbitrary commands with the privileges of the API process, potentially compromising the device and any systems connected to it. The flaw is classified as CWE‑74 and CWE‑77.

Ziroom ZHOME A0101 1.0.1.0 is affected by the pop_usb_device injection flaw. No vendor‑supplied patch or firmware update has been publicly documented, so all devices running this version remain vulnerable.

The CVSS score of 9.4 indicates critical severity. With a publicly available exploit and no known fix from the vendor, the likelihood of exploitation is significant. The EPSS score of 2 % suggests that, while overall exploitation probability is low to moderate, the presence of an active exploit and remote attack vector increase risk. The vulnerability is not listed in the CISA KEV catalog at this time.