CVE-2026-108576: Critical Command Injection in TOZED X300 Router
A critical command injection vulnerability identified as CVE-2026-108576 has been reported in the TOZED ZLT X300 5G Customer Premises Equipment (CPE) router. The vulnerability affects firmware versions up to 6.01.3 and may allow remote attackers to execute operating system commands with elevated privileges.
The vulnerability received a reported CVSS score of 10.0, placing it in the Critical severity category. According to the published researcher advisory, the issue involves insufficient validation of the Host parameter used by the router's IPPingDiagnostics functionality.
At the time of writing, the public advisory lists no patched version.
What Is CVE-2026-108576?
CVE-2026-108576 concerns an operating system command injection weakness in the TOZED X300 router's IPPingDiagnostics handling.
Command injection occurs when an application places untrusted input into an operating system command without properly validating or handling that input. If an attacker can influence how the command is constructed, the operating system may interpret unintended input as executable instructions.
In this case, the published vulnerability description identifies the Host argument in the process_ping function as the affected input.
The researcher advisory provides additional technical context, describing how the router's TR-069/CWMP client processes the diagnostic parameter and how the resulting command may execute with root privileges.
Affected Devices and Firmware
The currently published information identifies the following affected scope:
Product: TOZED ZLT X300 5G CPE router
Affected firmware: Versions up to and including 6.01.3
Vulnerability type: OS command injection
CWE: CWE-78
Reported severity: CVSS 10.0 — Critical
Patch status: No patched version listed in the referenced advisory
Administrators should verify the exact device model and firmware with their Internet service provider or device vendor rather than assuming that every router in the same product family has identical firmware or exposure.
Why Is This Vulnerability Serious?
Successful command injection can have consequences far beyond the affected diagnostic function.
Because the published advisory describes command execution with root privileges, a successful attack could potentially compromise the router's operating system and affect its confidentiality, integrity, and availability.
Depending on the device configuration and network architecture, a compromised router may also create risks for other systems that rely on it for network connectivity.
The researcher advisory describes a possible over-the-air attack scenario involving a rogue LTE base station and software-defined radio equipment. This is a specialized attack scenario, not evidence that every internet-connected X300 can be compromised through an ordinary remote connection.
The detailed attack conditions should be evaluated against the original advisory and the actual deployment environment.
Recommended Mitigation
No official patched firmware is listed in the public advisory at the time of writing. Until the vendor or service provider publishes verified guidance, device owners should consider the following precautions.
1. Verify the Device and Firmware
Identify whether the deployed equipment is a TOZED ZLT X300 and record its current firmware version. Ask the device vendor or Internet service provider whether the device is affected and whether an official security update or workaround is available.
2. Restrict Management Access
Disable unnecessary remote administration features and restrict management interfaces to trusted networks wherever supported. Review the configuration of TR-069/CWMP management according to the service provider's approved guidance.
These measures can reduce some exposure, but they should not be assumed to eliminate the specific radio-layer attack scenario described by the researcher.
3. Contact the Vendor or Service Provider
Request a written advisory, mitigation instructions, or an estimated remediation plan. Avoid installing unofficial firmware from unverified sources, especially on network equipment that supports critical connectivity.
4. Review Network Security
Monitor available device and network logs for unusual management activity or unexpected configuration changes. Consider isolating sensitive internal systems from network equipment that cannot currently be brought to a supported security state.
Conclusion
CVE-2026-108576 highlights the security risks created by insufficient input validation in network device management functions.
With a reported CVSS score of 10.0 and no patched version listed in the referenced advisory, affected device owners should verify their firmware, consult their provider, and follow official mitigation guidance.
Further conclusions about exploitability and remediation should be based on updated vendor documentation and independently verified technical evidence.
References
Information checked on October 13, 2026. Vulnerability details and remediation status may change as further advisories become available.
