A vulnerability was found in TOZED X300 up to 6.01.3. (CVE-2026-108576)

CVE-2026-108576 describes a critical vulnerability in TOZED X300 firmware versions up to 6.01.3. The vulnerability resides in the process_ping function of the IPPingDiagnostics Handler component. An attacker can remotely exploit this flaw by manipulating the Host argument, resulting in OS command injection. This allows execution of arbitrary commands with potentially full system privileges. The vendor was contacted early but did not provide any response or remediation guidance. No official patch or fix has been disclosed.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on affected TOZED X300 devices, leading to full compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete system impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, affected users should consider disabling the vulnerable IPPingDiagnostics Handler functionality if possible or isolate affected devices from untrusted networks until a fix is released.