TOZED X300 CVE-2026-108576

Exploitation requires network access to the TOZED X300 IP Ping Diagnostics feature (the process_ping function of the IPPingDiagnostics Handler), typically exposed through the device's web management interface. The attacker supplies OS shell metacharacters in the Host argument of the ping diagnostic request; no authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). The primary LIMITING factor is reachability of the management/diagnostics interface: on CPE devices this is frequently bound to the LAN or an administrative VLAN rather than the WAN, so internet-wide exploitation depends on whether the diagnostics UI is exposed externally. Only versions up to and including 6.01.3 are affected, and no vendor patch is currently available.

All severity signals converge on maximum severity: the provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 10.0 and describes remote, unauthenticated, low-complexity exploitation with high impact to confidentiality, integrity, and availability, which is fully consistent with the CWE-78 OS command injection described in the process_ping/IPPingDiagnostics handler. There are no conflicting signals between the vector and the description - both point to trivial remote code execution via the manipulated Host argument. However, several decision-critical signals are MISSING from the input: no EPSS probability was provided, there is no CISA KEV listing, and no SSVC decision record was supplied, so exploitation likelihood cannot be quantified from this data. No public exploit was identified at time of analysis - note that the attached GitHub security advisory (GHSA-qcpp-vfr2-v242) is filed under a DIFFERENT identifier (CVE-2026-2035703), so it should NOT be treated as confirmed POC for this CVE without manual verification. The net result is a technically maximal-severity flaw whose real-world priority is tempered by (a) the likely low deployment footprint of this CPE-class device and (b) the fact that exploitation requires reaching the device management interface, which is often not internet-exposed. Treat as high priority for any environment running TOZED X300, but the absence of EPSS/KEV means widespread opportunistic exploitation is not confirmed.

An attacker with network reachability to the TOZED X300 management/diagnostics interface sends a crafted request to the IPPingDiagnostics handler, placing shell metacharacters in the Host parameter consumed by process_ping. Because the input is passed to an OS command without sanitization, the injected commands execute with the privileges of the web service (typically root on embedded CPE), yielding full device takeover. No authentication or user interaction is required per the CVSS vector; no public exploit code was identified in the provided data, though the technique is trivial to reproduce.