Subject: CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-08 17:30 UTC
Importiert: 2026-09-08 18:19 UTC
Quelle-ID: full_disc
uid_hash: 3eeb5ad182afc881b8f44a04d45afd99c04be51104a7d4974cfc5af2f8005b48

Full Disclosure

Posted by Surf free on Sep 08 Tozed ZLT X300 5G CPE Router firmware 6.01.3 contains an OS command

injection vulnerability (CWE-78) in the TR-069/CWMP client daemon

(netcwmpd). The IPPingDiagnostics Host parameter is passed unsanitized into

sprintf, which constructs a shell command executed via system_by_root() as

root.

An attacker operating a rogue LTE base station using SDR hardware (~$300)

can impersonate the carrier's Auto Configuration Server and inject

arbitrary...

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-2035703

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss