{"id":"CVE-2026-108576","published":"2026-10-11T13:17:13.067","lastModified":"2026-10-13T20:17:20.653","description":"A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108576","tags":[]},{"url":"https://vuldb.com/submit/956290","tags":[]},{"url":"https://vuldb.com/vuln/416233","tags":[]},{"url":"https://vuldb.com/vuln/416233/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242","tags":[]}],"hasPoc":true,"ai":{"summary":"A remote OS command injection vulnerability exists in TOZED X300 devices' IPPingDiagnostics Handler, allowing attackers to execute arbitrary commands on the device through the Host parameter. This critical flaw enables full system compromise without requiring authentication.","exploitability":"The vulnerability is highly exploitable with no prerequisites, as it allows remote command execution through a simple HTTP request that passes user-controllable input directly into an OS command.","blast_radius":"If exploited, this vulnerability could allow attackers to gain complete control over affected TOZED X300 devices, potentially enabling them to execute arbitrary code, access sensitive data, or use the compromised devices as launch points for further attacks.","remediation":"Upgrade to firmware version 6.01.4 or later to remediate this command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","ics","command-injection","remote"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:42:34.663Z"}}