CVE-2026-108576

{
  "etk_id": "ETK-2026-1255",
  "cve_id": "CVE-2026-108576",
  "display_id": "CVE-2026-108576",
  "ghsa_id": "GHSA-f93g-mm3v-vv75",
  "euvd_id": "EUVD-2026-96983",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OS command injection in TOZED X300 IPPingDiagnostics",
  "summary": "TOZED X300 devices running firmware 6.01.3 or earlier are affected by an OS command injection flaw in the IPPingDiagnostics handler. An attacker who can reach the diagnostic interface and supply its host input may execute operating-system commands remotely.",
  "mitigation": "Restrict access to the device management and diagnostic interfaces to trusted administrative networks, or disable the IPPingDiagnostics function if possible. Monitor for and apply a vendor firmware update when one is available; the evidence does not identify a fixed version.",
  "vendor": "tozed",
  "product": "X300",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "6.01.0",
        "6.01.1",
        "6.01.2",
        "6.01.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "X300",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0245,
  "epss_percentile": 0.8417,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.205086666666666,
  "t0_at": "2026-10-11T12:15:13.822000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-11T12:15:13.822000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-11T12:15:13.822000+00:00",
      "url": "https://github.com/advisories/GHSA-f93g-mm3v-vv75"
    }
  }
}