X300
Monthly
Unauthenticated OS command injection in TOZED X300 devices up to firmware version 6.01.3 allows remote attackers to execute arbitrary operating system commands by supplying shell metacharacters in the Host argument of the IP Ping Diagnostics feature, which is typically exposed through the device's web management interface. All severity signals converge on maximum risk: the vulnerability scores 10.0 under CVSS 4.0 with high impact to confidentiality, integrity, and availability, and the vendor did not respond to disclosure and has not released a patch. Exploitation is limited primarily by whether the diagnostics interface is reachable from the attacker's network, as it is often bound to a LAN or administrative VLAN rather than the WAN; no public exploit identified at time of analysis.
Unauthenticated OS command injection in TOZED X300 devices up to firmware version 6.01.3 allows remote attackers to execute arbitrary operating system commands by supplying shell metacharacters in the Host argument of the IP Ping Diagnostics feature, which is typically exposed through the device's web management interface. All severity signals converge on maximum risk: the vulnerability scores 10.0 under CVSS 4.0 with high impact to confidentiality, integrity, and availability, and the vendor did not respond to disclosure and has not released a patch. Exploitation is limited primarily by whether the diagnostics interface is reachable from the attacker's network, as it is often bound to a LAN or administrative VLAN rather than the WAN; no public exploit identified at time of analysis.