CVE-2026-108576

Summary

A remote OS command injection vulnerability exists in TOZED X300 devices' IPPingDiagnostics Handler, allowing attackers to execute arbitrary commands on the device through the Host parameter. This critical flaw enables full system compromise without requiring authentication.

Exploitability

The vulnerability is highly exploitable with no prerequisites, as it allows remote command execution through a simple HTTP request that passes user-controllable input directly into an OS command.

Blast radius

If exploited, this vulnerability could allow attackers to gain complete control over affected TOZED X300 devices, potentially enabling them to execute arbitrary code, access sensitive data, or use the compromised devices as launch points for further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 6.01.4 or later to remediate this command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.