TI-2026-70564 Aliases CVE-2026-108576 GHSA-f93g-mm3v-vv75

OS command injection in TOZED X300 IPPingDiagnostics process_ping

MEDIUM 56CWE-77Published 2026-10-11 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability in the process_ping function of the IPPingDiagnostics Handler in TOZED X300 up to 6.01.3 allows OS command injection through the Host argument. The attack can be launched remotely, and CVSS 4.0 scores it 10.0 (CRITICAL). The vendor was contacted early about this disclosure but did not respond. The weaknesses are CWE-77 and CWE-78.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.04068 90th percentileScored 2026-11-08

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TOZED	X300	6.01.0; 6.01.1; 6.01.2; 6.01.3	—	No fix listed	CNA

X300 VendorTOZED Affected 6.01.0; 6.01.1; 6.01.2; 6.01.3 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tozed:x300::::::::	—	—	—

cpe:2.3:a:tozed:x300:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

The sources list no fixed version for TOZED X300.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-11 Threatist record created from CVE-2026-108576
2026-10-11 Alias added: GHSA-f93g-mm3v-vv75
2026-10-13 CISA SSVC decision points changed
2026-10-25 EPSS moved to the 90th–95th percentile

References

Other 1

https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242

TI-2025-13760 TOZED ZLT M30s Web Management proc_post information disclosure CVSS 4.0MEDIUM 6.9
TI-2025-04575 TOZED ZLT W51 Service Port 7777 heap inspection CVSS 4.0MEDIUM 6.9
TI-2025-11834 TOZED ZLT T10 Reboot proc_post denial of service CVSS 4.0MEDIUM 5.3
TI-2025-13761 TOZED ZLT M30s UART on-chip debug and test interface with improper access control CVSS 4.0LOW 1.0
TI-2025-12907 TOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentials CVSS 4.0HIGH 8.7
TI-2025-12887 TOZED ZLT M30S/ZLT M30S PRO Web proc_post denial of service CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences