CVE-2026-108576: Unauthenticated OS Command Injection in TOZED X300 Router (CVSS 10.0)

Maximum-Severity Command Injection in a Consumer/SMB 4G-5G Router

A critical, unauthenticated OS command injection vulnerability has been disclosed in the TOZED X300, a 4G/5G CPE (customer-premises equipment) router, affecting firmware versions 6.01.0 through 6.01.3. Tracked as CVE-2026-108576 and published on October 11, 2026, the flaw carries a maximum CVSS score of 10.0 (Critical) — the highest possible rating — because it requires no authentication, no user interaction, and no special privileges, and can be triggered entirely over the network.

The vulnerability lives in the process_ping function of the device's IPPingDiagnostics Handler, a network diagnostics component that is part of the standard TR-069/CWMP (CPE WAN Management Protocol) "IP Ping Diagnostics" data model used by ISPs and management platforms to remotely test connectivity on deployed CPE devices. The handler's Host argument is passed into an operating-system command without sanitizing shell metacharacters, allowing an attacker to append arbitrary commands to the value and have them executed with the privileges of the diagnostics process. According to the disclosing researcher, the vendor was contacted early about the issue but did not respond, and no patched firmware has been published as of this writing.

Vulnerability Details

How the Vulnerability Works

Step 1: A Standard Diagnostics Feature

TR-069/CWMP (also referred to as TR-143) defines an IPPingDiagnostics data model object that ISPs and remote management platforms use to instruct a CPE device to run a network connectivity test — essentially a remote-triggered ping. The Host parameter specifies the target address or hostname the device should ping.

Step 2: Unsanitized Input Reaches a Shell Command

The process_ping function that handles this request builds an operating-system command using the value supplied in Host, but it does not neutralize shell metacharacters such as ;, |, &, backticks, or $() sequences before doing so. Because the diagnostics handler is reachable without authentication, any value an attacker supplies for Host is passed straight through to the underlying command interpreter.

Step 3: Arbitrary Command Execution

By appending a shell separator and a second command to the Host value — for example, a string shaped like a normal IP address followed by a semicolon and an arbitrary shell command — an attacker causes the device to execute that second command with whatever privileges the diagnostics process holds. No valid credentials, session, or user interaction are needed at any step, and the entire attack can be carried out remotely over the network.

Step 4: Full Device Compromise

Because the injected command runs in the context of the router's management/diagnostics process, successful exploitation gives an attacker a foothold on the device itself — enabling configuration tampering, traffic interception or redirection, use of the router as a pivot point into the connected LAN, or recruitment of the device into a botnet.

Impact Assessment

Recommendations

For ISPs and Device Administrators

1. Disable WAN-side (internet-facing) management and TR-069/CWMP access on X300 units where it is not strictly required for remote provisioning.
2. Restrict the management/diagnostics interface to trusted management VLANs or ACME server IP ranges only — it should never be reachable from the general internet.
3. Inventory all deployed TOZED X300 units and their firmware versions; treat every unit running 6.01.0–6.01.3 as vulnerable until the vendor confirms a fix.
4. Monitor vendor channels for a patched firmware release. As of this writing, TOZED has not responded to the disclosure or published a fix — check for updates regularly.

For Security Teams

1. Scan for internet-exposed TR-069/CWMP endpoints (commonly ports 7547 and similar) across managed and customer-facing IP ranges.
2. Add detection content for CVE-2026-108576 once vendor or community signatures become available, and watch threat intelligence feeds for exploitation reports given the CVSS 10.0 rating.
3. Treat CPE/IoT routers as untrusted network citizens — segment them away from internal management and critical systems regardless of patch status.
4. Flag this CVE for urgent tracking in vulnerability management platforms; a no-auth, network-reachable CVSS 10.0 issue with no vendor patch is a standing risk until mitigated.

For End Users

1. Do not expose your router's management interface to the internet. Confirm remote/WAN management is disabled unless your ISP explicitly requires it.
2. Check with your ISP or TOZED for firmware update guidance if you know or suspect you are running an X300 device.
3. Place IoT and CPE devices on an isolated network segment where possible, separate from computers and other sensitive devices.
4. Reboot and monitor your device for unusual behavior (unexpected reboots, configuration changes, unfamiliar connected devices) as a precaution.

Key Takeaways

1. CVE-2026-108576 scores a maximum CVSS 10.0 — it requires no authentication, no privileges, and no user interaction, and is exploitable entirely over the network.
2. The flaw lives in a standard TR-069/CWMP diagnostics feature (IPPingDiagnostics / process_ping), meaning any management system or attacker able to reach the handler can trigger it.
3. The root cause is classic unsanitized input passed to a shell command (CWE-78/CWE-77) — the Host parameter is never neutralized before being used to build an OS command.
4. No vendor response and no patch are currently available. TOZED was contacted early in the disclosure process but did not respond, leaving network-level mitigation as the only available defense.
5. CPE/router devices are high-value, often-overlooked targets. Their internet-facing management interfaces and typically slow patch cycles make them attractive for botnet recruitment and network pivoting.
6. Immediate mitigation is network segmentation and disabling WAN-side management — not a firmware update, since none exists yet.

Sources

• CVE-2026-108576 — National Vulnerability Database (NVD)
• CVE-2026-108576 — VulDB
• CVE-2026-108576 — OffSeq Threat Radar
• CVE-2026-108576 — Strix.ai Vulnerability Database