The IPPingDiagnostics component of TOZED X300 processes a Host argument that, if passed to process_ping(), is directly inserted into an operating‑system command. This yields a classic OS command injection, allowing an attacker controlling the Host value to execute arbitrary commands on the device. If the attacker can reach the component remotely, they can gain full control of the device, compromising confidentiality, integrity, and availability. The weakness corresponds to standard command‑injection vulnerabilities identified by CWE-77 and CWE-78.

The flaw exists in TOZED X300 routers running firmware versions up to and including 6.01.3. Devices of this model and firmware revision remain vulnerable unless they are upgraded beyond version 6.01.3. The vendor product is identified as TOZED:X300.

The CVSS score of 10 indicates the maximum severity, and the attack can be launched purely remotely without local privileges. The EPSS score of 4% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that, due to the absence of a publicly available patch and the nature of the flaw, exploitation may be likely if the device remains exposed to an Internet or untrusted network. It is further inferred that attackers could immediately run rogue commands, potentially escalating to full system compromise.