| शीर्षक | Tozed Kangwei ZLT X300 6.01.3 Command Injection |
|---|
| विवरण | The Tozed ZLT X300 5G CPE router contains a critical OS command injection vulnerability in its TR-069/CWMP client daemon (netcwmpd). The IPPingDiagnostics handler
(process_ping function at 0x463A14) passes the Host parameter from TR-069 SetParameterValues directly into a sprintf format string at 0x463E6C that builds a shell
command. The command is executed via system_by_root() as root through the service_shell dispatcher chain (sub_5BA8C4 → sub_5BC23C → sub_5BBC88). No input validation is
performed on the Host parameter.
CVSS: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-78
Advisory: https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242
Researcher: danish1162 (HackerOne/Bugcrowd/GitHub) |
|---|
| स्रोत | ⚠️ https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242 |
|---|
| उपयोगकर्ता | danish1162 (UID 100944) |
|---|
| सबमिशन | 02/09/2026 01:12 AM (1 महीना पहले) |
|---|
| संयम | 10/10/2026 05:42 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416233 [TOZED X300 तक 6.01.3 IPPingDiagnostics process_ping Host अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|