Summary
A command injection vulnerability in the Ziroom ZHOME A0101 USB Device Management API allows attacker-controlled path input to influence operating system command execution.
Because the affected API may be reachable remotely, an attacker who can access it could execute unauthorized commands with the privileges of the service. The issue is rated Critical with a CVSS base score of 9.1.
Affected context
The vulnerability occurs in the pop_usb_device function within usr/lib/lua/luci/controller/api/zrUsb.lua, which handles USB device management requests. It becomes risky when externally supplied path data is incorporated into command execution without sufficient separation, validation, or escaping, particularly where the API is exposed to untrusted networks.
Exploit preconditions
- Attack surface: USB Device Management API exposed through the device's web or LuCI interface
- Required access: Network access to the affected API; authentication requirements depend on the device's deployment and access controls
- Trigger point: Processing of a request handled by the
pop_usb_devicefunction - Why exploitation is possible: Path input can reach an operating system command context without adequate command and argument separation
Why this happens
The underlying flaw is the unsafe construction or invocation of operating system commands using attacker-influenced path data. When input is passed into a shell or command interpreter without strict validation and safe argument handling, command syntax can be interpreted as executable instructions rather than data.
This maps primarily to CWE-77: Improper Neutralization of Special Elements used in a Command, with CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component describing the broader injection class.
Potential impact
- An attacker may execute arbitrary commands on the affected device.
- Device configuration and local data could be modified or destroyed.
- Network credentials, tokens, or other sensitive information could be exposed.
- The device could be used for persistence, lateral movement, or additional attacks.
- Availability of USB management and other device services could be disrupted.
General mitigation guidance
Mitigation generally focuses on eliminating shell interpretation and reducing trust in request parameters.
Common defensive patterns include:
- Using direct process-execution APIs with fixed commands and separate argument arrays instead of shell evaluation.
- Restricting path inputs to approved device identifiers or canonical paths.
- Applying allowlists, type checks, length limits, and canonicalization before processing input.
- Ensuring service accounts and device processes run with the minimum required privileges.
- Limiting administrative APIs to trusted management networks and authenticated, authorized users.
- Separating USB management operations from higher-privilege system functionality where practical.
How teams detect issues like this
Detection can include static analysis for shell execution APIs receiving request parameters, string concatenation involving command paths, and use of shell wrappers in Lua code.
Code review should examine whether API arguments are validated against an allowlist and whether process calls preserve argument boundaries. Runtime monitoring can alert on unexpected command execution, unusual child processes, or USB management requests from untrusted network locations. CI policy checks and automated code review tools may help identify command-injection patterns before deployment.
