#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL TOZED X300 ROUTER FLAW ENABLES ROOT CODE EXECUTION October 11, 2026 DISCLOSED BY: VulDB CNA / Muhammad Nadeem Danish PRODUCT: TOZED ZLT X300 5G CPE Router CVE: CVE-2026-108576 SEVERITY: Critical — CVSS 10.0 AFFECTED VERSIONS: Firmware through 6.01.3. Researcher-tested firmware: 6.01.3. IMPACT: OS command injection in the TR-069/CWMP IPPingDiagnostics handler allows attacker-controlled Host parameters to reach shell execution with root privileges. EXPOSURE: The research demonstrates an over-the-air attack involving a rogue LTE base station impersonating the carrier’s management infrastructure. Radio proximity and successful management-server impersonation are prerequisites for this demonstrated attack path. EXPLOITATION STATUS: RESEARCH-DEMONSTRATED RCE. The researcher reports successful laboratory exploitation on personally owned hardware. No confirmed malicious exploitation in the wild. No verified fixed firmware identified. Forensic triage: Inspect CWMP diagnostic activity, unexpected command execution, unauthorized configuration changes, suspicious root processes and altered network settings. No confirmed campaign-specific IOCs. URGENT ACTION: Identify affected routers. Contact the equipment provider for verified remediation guidance. Restrict untrusted management access and disable unnecessary remote diagnostics where supported. Do not assume ordinary internet-facing firewall rules eliminate the demonstrated radio-based attack path. SOURCE: https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242 CVE RECORD: https://github.com/advisories/GHSA-f93g-mm3v-vv75 CONFIDENCE: HIGH — CNA record and detailed researcher technical evidence. Real-world exploitation remains unverified. The original research predates the October 11 CVE publication. #CyberSecurity #ThreatIntel #TOZED #RouterSecurity #RCE #NetworkSecurity