TOZED X300 Firmware Has Critical Remote OS Command Injection Flaw

A critical remote code execution vulnerability has been identified in TOZED X300 network devices. The flaw allows attackers to inject operating system commands through the device's ping diagnostics feature.

What happened

The National Vulnerability Database recorded CVE-2026-108576 as a critical severity issue with a CVSS score of 10. This vulnerability exists in the `process_ping` function within the IPPingDiagnostics Handler component. Attackers can manipulate the `Host` argument to achieve operating system command injection remotely.

The issue affects TOZED X300 devices running firmware versions 6.01.0, 6.01.1, 6.01.2, and 6.01.3. According to the NVD record, the weakness maps to CWE-78 and CWE-77, which relate to OS command injection flaws. The attack vector is remote, meaning no local access is required for exploitation.

The vendor was contacted early in the disclosure process about this specific vulnerability. The NVD record states that the vendor did not respond in any way to these initial communications. No patched firmware version has been released or confirmed by the vendor at this time.

Why it matters

A CVSS score of 10 indicates that the vulnerability is critical and easily exploitable. Remote OS command injection allows an attacker to take full control of the affected device. This could lead to data theft, network pivoting, or the installation of additional malware.

The IPPingDiagnostics Handler is a functional component that likely processes network connectivity checks. Manipulating the `Host` argument in this function bypasses expected input validation. This allows malicious code to be executed by the underlying operating system of the TOZED X300 device.

Security teams must treat this as an immediate risk for any exposed TOZED X300 units. The lack of vendor response leaves users without an official remediation path. Organizations relying on these devices for network monitoring or connectivity must assess their exposure.

What to watch

• Monitor for unusual outbound traffic from TOZED X300 devices.
• Check for unauthorized changes to device configurations or firmware.
• Look for signs of the device being used in botnet activity.
• Watch for failed authentication attempts on the device management interface.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: TOZED

• Isolate affected TOZED X300 devices from the main network immediately.
• Block external access to the device management interface via firewall rules.
• Monitor network logs for unexpected ping commands or shell execution patterns.
• Contact the vendor directly to inquire about a potential firmware update.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which TOZED X300 firmware versions are affected by CVE-2026-108576?

Versions 6.01.0, 6.01.1, 6.01.2, and 6.01.3 are affected by this vulnerability.

Is there a patch available for this OS command injection flaw?

No patch has been confirmed yet, as the vendor did not respond to early contact.

How is the vulnerability exploited in the IPPingDiagnostics Handler?

Attackers manipulate the `Host` argument in the `process_ping` function to inject commands.