CVE-2026-108576 is a critical OS command injection flaw in the IPPingDiagnostics Handler of the TOZED X300, in versions up to 6.01.3. Its CVSS rating says an attacker could exploit it remotely without authentication. The vendor has not responded to the disclosure.
What Is It
The flaw is in the process_ping function of the TOZED X300's IPPingDiagnostics Handler component. An attacker can change the Host argument to inject operating system commands (VulDB). The CNA classifies it as CWE-77 (Command Injection) and CWE-78 (OS Command Injection). VulDB, the reporting CNA, published it on October 11, 2026. The NVD entry lists its status as "Received."
Why It Matters
VulDB gives this flaw the maximum CVSS score of 10.0 (Critical) under v3.1, v4.0 and v2.0 (VulDB; NVD). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Under this rating:
- The flaw can be exploited over the network.
- The attack complexity is low.
- An attack needs no privileges and no user action.
- A successful exploit could affect resources beyond the vulnerable component (changed scope).
- A successful exploit could fully compromise confidentiality, integrity and availability.
These are CVSS severity ratings, not observed attack outcomes. The CVSS 4.0 vector also rates the potential impact on connected systems as high for confidentiality, integrity and availability.
KEV status: This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The available data does not confirm any exploitation in the wild.
What's Vulnerable
- Vendor: TOZED
- Product: X300
- Component: IPPingDiagnostics Handler (
process_ping) - Affected versions: All versions up to and including 6.01.3
- CPE:
cpe:2.3:a:tozed:x300:*:*:*:*:*:*:*:*
The description says all versions "up to 6.01.3" are affected but does not list them individually or give a lower bound (NVD; VulDB). Treat any X300 firmware at or below 6.01.3 as potentially vulnerable.
Patch Status
The available records list no patch or fixed version. The disclosure says the vendor was contacted early but "did not respond in any way" (VulDB). Because the CVE is not in KEV, CISA has not set a required action for it. If you run an affected X300, check the advisories below and watch for a vendor update.
Sources
- NVD: CVE-2026-108576
- CISA Known Exploited Vulnerabilities Catalog
- GitHub Security Advisory GHSA-qcpp-vfr2-v242 (listed in the CVE references; the repository name gives a different CVE identifier, and this brief has not confirmed that the advisory covers CVE-2026-108576)
- VulDB: CVE-2026-108576
- VulDB: Submission 956290
- VulDB: Vulnerability 416233
- VulDB: Vulnerability 416233 CTI