{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ZLT X300 / X300A 5G CPE Router",
          "vendor": "Tozed Kangwei Tech Co., Ltd (Shenzhen, China)",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Surf free"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tozed ZLT X300 5G CPE Router firmware 6.01.3 contains an OS command\ninjection vulnerability (CWE-78) in the TR-069/CWMP client daemon\n(netcwmpd). The IPPingDiagnostics Host parameter is passed unsanitized into\nsprintf, which constructs a shell command executed via system_by_root() as\nroot.\n\n\nAn attacker operating a rogue LTE base station using SDR hardware (~$300)\ncan impersonate the carrier\u0027s Auto Configuration Server and inject\narbitrary shell commands as root. No authentication, user interaction, or\nphysical access is required.\n\n\n2. CVE ID: CVE-2026-2035703\n\n   CVSS: 9.8 (Critical)\n\n   CWE: CWE-78 (OS Command Injection)\n\n\n3. AFFECTED PRODUCT\n\n   Vendor: Tozed Kangwei Tech Co., Ltd (Shenzhen, China)\n\n   Product: ZLT X300 / X300A 5G CPE Router\n\n   Firmware: 6.01.3 (all versions believed affected)\n\n   Architecture: aarch64 (MediaTek MT7992, OpenWrt 23.05.5)\n\n\n4. VULNERABLE CODE (IDA Pro decompilation, netcwmpd at 0x463E6C)\n\n\n   sprintf(cmd,\n\n       \"ping%s -c %d -s %d -W %u%s \\\"%s\\\" \u003e /tmp/.tr069_pingtest.log\",\n\n       ipv4_flag, repetitions, block_size, timeout, interface,\n\n       HOST);  // unsanitized TR-069 parameter\n\n\n   Execution chain:\n\n   sprintf (0x463E6C) -\u003e sub_5BA8C4 (opcode 0x13)\n\n   -\u003e sub_5BC23C (service_shell handler)\n\n   -\u003e sub_5BBC88 -\u003e system_by_root(cmd)\n\n\n5. ATTACK VECTOR\n\n   Rogue LTE eNodeB (srsRAN + USRP/ANTSDR, ~$300) within\n\n   radio range impersonates carrier ACS, sends TR-069\n\n   SetParameterValues with injected Host parameter.\n\n\n6. IMPACT\n\n   - Full root compromise (uid=0, gid=0)\n\n   - Mass surveillance, DNS hijacking, traffic interception\n\n   - Credential theft (WiFi, TR-069, IMEI)\n\n   - Persistent backdoor installation\n\n   - Lateral movement to all LAN devices\n\n\n7. AFFECTED CARRIERS (partial list)\n\n   du (UAE), STC/Mobily (Saudi Arabia), EE/O2/Three (UK),\n\n   Telekom (Germany), Orange/SFR (France), Singtel (Singapore),\n\n   MTN (South Africa/Nigeria), and others in 15+ countries.\n\n\n8. VENDOR RESPONSE\n\n   Vendor has no PSIRT. Refused to engage after multiple\n\n   disclosure attempts. Claimed fix without evidence.\n\n   ZTE PSIRT confirmed: \"not our product.\"\n\n\n9. COORDINATION\n\n   CERT/CC: VRF#26-09-VVTLF\n\n   ZDI: Case danish11620001\n\n   aeCERT: Notified\n\n   CISA: Notified\n\n\n10. ADVISORY\n\n\nhttps://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242\n\n\n11. TIMELINE\n\n    2026-08-14  Reported to vendor (global_marketing () gztozed com)\n\n    2026-08-22  Vendor claimed \"fixed\" \u2014 no evidence\n\n    2026-08-27  Vendor refused further engagement\n\n    2026-08-29  Public disclosure via GitHub Security Advisory\n\n    2026-09-05  Full disclosure\n\n\n12. CREDIT\n\n    Muhammad Nadeem Danish (danish1162)\n\n    https://hackerone.com/danish1162\n\n    https://github.com/danish1162\n\n\n13. TESTING ENVIRONMENT\n\n    All live testing in private lab (Pakistan), sysmocom test\n\n    SIM (IMSI 999, ITU reserved), Band 7 (unoccupied).\n\n    No live commercial network affected.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:37Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/32"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/32"
        },
        {
          "url": "https://github.com/danish1162"
        },
        {
          "url": "https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242"
        },
        {
          "url": "https://hackerone.com/danish1162"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/32"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "**Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE \u2014 Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0306",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/32",
            "automated": true,
            "contentSha256": "d6bf529d0d190b2876c7112ce53e5f6fc49c1a42f7edd39d7d4565dac52d24e2",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/32",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-05T17:07:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:02:11Z",
    "dateUpdated": "2026-09-09T13:04:37Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0306"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}