**Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)

[Surf free <surfv.free () gmail com>]

Tozed ZLT X300 5G CPE Router firmware 6.01.3 contains an OS command
injection vulnerability (CWE-78) in the TR-069/CWMP client daemon
(netcwmpd). The IPPingDiagnostics Host parameter is passed unsanitized into
sprintf, which constructs a shell command executed via system_by_root() as
root.


An attacker operating a rogue LTE base station using SDR hardware (~$300)
can impersonate the carrier's Auto Configuration Server and inject
arbitrary shell commands as root. No authentication, user interaction, or
physical access is required.


2. CVE ID: CVE-2026-2035703

   CVSS: 9.8 (Critical)

   CWE: CWE-78 (OS Command Injection)


3. AFFECTED PRODUCT

   Vendor: Tozed Kangwei Tech Co., Ltd (Shenzhen, China)

   Product: ZLT X300 / X300A 5G CPE Router

   Firmware: 6.01.3 (all versions believed affected)

   Architecture: aarch64 (MediaTek MT7992, OpenWrt 23.05.5)


4. VULNERABLE CODE (IDA Pro decompilation, netcwmpd at 0x463E6C)


   sprintf(cmd,

       "ping%s -c %d -s %d -W %u%s \"%s\" > /tmp/.tr069_pingtest.log",

       ipv4_flag, repetitions, block_size, timeout, interface,

       HOST);  // unsanitized TR-069 parameter


   Execution chain:

   sprintf (0x463E6C) -> sub_5BA8C4 (opcode 0x13)

   -> sub_5BC23C (service_shell handler)

   -> sub_5BBC88 -> system_by_root(cmd)


5. ATTACK VECTOR

   Rogue LTE eNodeB (srsRAN + USRP/ANTSDR, ~$300) within

   radio range impersonates carrier ACS, sends TR-069

   SetParameterValues with injected Host parameter.


6. IMPACT

   - Full root compromise (uid=0, gid=0)

   - Mass surveillance, DNS hijacking, traffic interception

   - Credential theft (WiFi, TR-069, IMEI)

   - Persistent backdoor installation

   - Lateral movement to all LAN devices


7. AFFECTED CARRIERS (partial list)

   du (UAE), STC/Mobily (Saudi Arabia), EE/O2/Three (UK),

   Telekom (Germany), Orange/SFR (France), Singtel (Singapore),

   MTN (South Africa/Nigeria), and others in 15+ countries.


8. VENDOR RESPONSE

   Vendor has no PSIRT. Refused to engage after multiple

   disclosure attempts. Claimed fix without evidence.

   ZTE PSIRT confirmed: "not our product."


9. COORDINATION

   CERT/CC: VRF#26-09-VVTLF

   ZDI: Case danish11620001

   aeCERT: Notified

   CISA: Notified


10. ADVISORY


https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242


11. TIMELINE

    2026-08-14  Reported to vendor (global_marketing () gztozed com)

    2026-08-22  Vendor claimed "fixed" — no evidence

    2026-08-27  Vendor refused further engagement

    2026-08-29  Public disclosure via GitHub Security Advisory

    2026-09-05  Full disclosure


12. CREDIT

    Muhammad Nadeem Danish (danish1162)

    https://hackerone.com/danish1162

    https://github.com/danish1162


13. TESTING ENVIRONMENT

    All live testing in private lab (Pakistan), sysmocom test

    SIM (IMSI 999, ITU reserved), Band 7 (unoccupied).

    No live commercial network affected.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/