TOZED X300: OS command injection in IPPingDiagnostics
Summary
The TOZED X300 5G CPE router (firmware up to 6.01.3) fails to validate the Host parameter of the IPPingDiagnostics function (process_ping). An attacker can inject operating system commands that run with root privileges. According to the disclosure, exploitation requires no authentication and no user interaction and can be launched remotely, possibly via a rogue LTE base station. The vendor did not respond to the early disclosure.
Affected
- TOZED X300 firmware 6.01.0
- TOZED X300 firmware 6.01.1
- TOZED X300 firmware 6.01.2
- TOZED X300 firmware 6.01.3
- Product naming and vendor identity should be confirmed, as sources also describe the device as ZLT X300 5G CPE.
Fixed in
Unknown.
Workaround
- Isolate affected devices from direct internet exposure.
- Restrict admin interfaces to trusted networks.
- Ask the carrier to disable TR-069 remote management if it is not required.
Exploitation
- Public technical write-up available (GHSA advisory, Full Disclosure September 2026).
- Public PoC code: unclear, not verified.
- Not listed in CISA KEV.
- No confirmed real-world attacks reported.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Identify all TOZED X300 / ZLT X300 devices in client networks and confirm firmware versions.
- Isolate the devices behind a firewall and do not use them as an unprotected internet gateway.
- Disable TR-069 remote management where possible and monitor for unexpected management traffic.
- Check the vendor site regularly for a fix; consider replacing the device if no patch appears.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Advisory GHSA-qcpp-vfr2-v242 github.com
- VulDB CVE-2026-108576 vuldb.com
- VulDB VDB-416233 vuldb.com
- Full Disclosure post (Sep 2026) seclists.org
- PacketStorm entry PACKETSTORM:231042 vulners.com
- HOL CVE summary hol.org
- TheHackerWire threat brief www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:28.
Original description (NVD)
A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.