TOZED X300 Firmware Critical RCE Flaw CVE-2026-108576 Unpatched; Vendor Ignored Disclosure Attempts

TOZED X300 firmware contains a critical remote code execution vulnerability. Attackers can exploit the IPPingDiagnostics Handler to inject operating system commands.

What happened

The National Vulnerability Database recorded CVE-2026-108576 with a CVSS score of 10.0. This rating classifies the issue as critical severity for remote exploitation. The flaw resides within the process_ping function of the IPPingDiagnostics Handler component. Attackers manipulate the Host argument to achieve operating system command injection. This technical weakness aligns with CWE-78 and CWE-77 classifications. The vulnerability is present in TOZED X300 firmware versions 6.01.0, 6.01.1, 6.01.2 and 6.01.3. Any version up to 6.01.3 is affected by this specific injection vector. The attack can be launched remotely without prior authentication.

Why it matters

The vendor was contacted early about this disclosure but did not respond. No patch or fix has been confirmed yet for these affected versions. Organizations using TOZED X300 devices remain exposed to unmitigated risk. Remote command injection allows attackers to execute arbitrary system commands. This capability can lead to full system compromise and lateral movement. The lack of vendor response leaves IT managers without an official remediation path. Critical severity scores indicate high exploitability and impact potential.

Next steps

• Audit networks for TOZED X300 devices running vulnerable firmware versions.
• Isolate affected devices from untrusted network segments immediately.
• Monitor logs for unusual command execution patterns on ping diagnostics.

What to do and how to stay safe: TOZED X300

• Restrict network access to the IPPingDiagnostics interface using firewall rules.
• Implement strict input validation for all host arguments in diagnostic tools.
• Monitor system logs for unexpected command executions or process spawns.
• Review vendor communications regularly for any future security updates.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which TOZED X300 firmware versions are affected by CVE-2026-108576?

Versions 6.01.0, 6.01.1, 6.01.2 and 6.01.3 are affected by this vulnerability.

Is there a patch available for this critical flaw?

No fix has been confirmed yet as the vendor did not respond to contact attempts.

How is the vulnerability exploited remotely?

Attackers manipulate the Host argument in the process_ping function to inject OS commands.