Threat database

CVE-2026-108576 is a critical OS command injection vulnerability in the TOZED X300 device, specifically in the IPPingDiagnostics Handler's process_ping function. It affects versions 6.01.0 through 6.01.3. The vulnerability allows remote attackers to inject arbitrary OS commands by manipulating the Host argument. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available.

A vulnerability was determined in TOZED ZLT M30s up to 1.47. The affected element is an unknown function of the component UART Interface. Executing manipulation can lead to on-chip debug and test interface with improper access control. The physical device can be targeted for the attack. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-15082 is a medium severity information disclosure vulnerability affecting TOZED ZLT M30s devices up to version 1.47. The flaw exists in the Web Management Interface, specifically in the /reqproc/proc_post file, where manipulation of the goformId argument can leak sensitive information. The vulnerability is remotely exploitable without authentication or user interaction, and an exploit has been publicly disclosed. Although the vendor was notified, no patch or response has been provided. This vulnerability could allow attackers to gain unauthorized access to information that may aid further attacks or compromise device confidentiality. European organizations using these devices in their network infrastructure could be at risk, especially in critical sectors relying on these devices. Mitigation requires network-level protections and monitoring due to the lack of vendor patches. Countries with higher adoption of TOZED ZLT M30s or strategic infrastructure using these devices are more likely to be impacted.

A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulation leads to hard-coded credentials. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-14105 is a medium-severity denial of service vulnerability affecting TOZED ZLT M30S and ZLT M30S PRO devices running firmware versions 1.47 and 3.09.06. The flaw exists in the web interface component, specifically in the /reqproc/proc_post function, where manipulation of the 'goformId' argument with the input 'REBOOT_DEVICE' can cause the device to become unavailable. Exploitation requires local network access, does not require authentication or user interaction, and can be performed remotely within the LAN. The vendor has not responded to disclosure attempts, and no patches are currently available. Although no known exploits are in the wild, the vulnerability has been publicly disclosed and could be leveraged to disrupt network availability. European organizations using these devices in their local networks may face service interruptions impacting operational continuity. Mitigation involves network segmentation, restricting local network access to trusted users, monitoring for suspicious POST requests targeting 'goformId', and considering device replacement or firmware updates if available.

A vulnerability was identified in TOZED ZLT T10 T10PLUS_3.04.15. The affected element is an unknown function of the file /reqproc/proc_post of the component Reboot Handler. Such manipulation leads to denial of service. Access to the local network is required for this attack to succeed. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.