CVE-2026-2035703: Tozed ZLT X300 5G CPE — Remote Root Code Execution via SDR Rogue Base Station

Status: Under coordinated disclosure (90-day embargo)
Discovered: 2026-08-08
Researcher: Muhammad Nadeem Danish (danish1162)
CVE ID: CVE-2026-2035703
Severity: Critical (CVSS 9.8)
CWE: CWE-78 (OS Command Injection)

Summary

The Tozed ZLT X300 5G CPE router contains a critical command injection vulnerability exploitable over-the-air via a rogue LTE base station (SDR). The device's TR-069/CWMP client (netcwmpd) passes unsanitized network-controlled input into shell commands, enabling unauthenticated remote root code execution.

An attacker operating a software-defined radio (~$300 USD) within radio range can impersonate the carrier's TR-069 ACS server and inject arbitrary shell commands that execute as root on the target device — with zero authentication, zero user interaction, and zero physical access.

Attack Vector

Attacker's SDR (~$300)
    ↓
Rogue LTE eNodeB (srsRAN, test frequency band)
    ↓ Strongest signal → X300 auto-connects
Rogue EPC assigns IP (172.16.0.x)
    ↓
TR-069 ACS impersonation (via DHCP Option 43)
    ↓
SetParameterValues: IPPingDiagnostics.Host = $(telnetd -l /bin/sh -p 4444)
    ↓
Device executes: ping "$(telnetd -l /bin/sh -p 4444)" as root
    ↓
ROOT SHELL on port 4444 — uid=0(root) gid=0(root)

Vulnerability Details

The IPPingDiagnostics handler in netcwmpd passes the Host parameter directly into a sprintf format string that builds a shell command:

// Decompiled from netcwmpd at 0x463E6C (IDA Pro)
sprintf(cmd,
    "ping%s -c %d -s %d -W %u%s \"%s\" > /tmp/.tr069_pingtest.log",
    ipv4_flag, repetitions, block_size, timeout, interface,
    HOST);  // HOST = unsanitized TR-069 parameter

The command is then executed via system() as root. No input validation is performed on the Host parameter — no character filtering, no regex check, no length validation beyond the 512-byte buffer.

$() command substitution is evaluated inside double quotes by POSIX shell, enabling arbitrary command execution.

Affected Device

Impact

• Full device takeover — root shell (uid=0), persistent backdoor installation
• Mass surveillance — redirect DNS, intercept all subscriber traffic
• Government facility compromise — any office using du 5G fixed wireless is vulnerable
• Credential theft — access /etc/shadow, WiFi passwords, TR-069 credentials, IMEI
• Botnet recruitment — persistent malware on thousands of CPE devices
• Lateral movement — pivot to all devices on the subscriber's LAN

Scope of Deployment

The ZLT X300 is deployed by carriers across:

Middle East: du (UAE), STC and Mobily (Saudi Arabia), Zain (Kuwait, Bahrain), Ooredoo and Omantel (Oman)
Europe: EE, O2, Three (UK), Telekom (Germany), TIM (Italy), Free Mobile, SFR, Orange (France)
Asia: Singtel (Singapore), AIS (Thailand), Smart (Philippines), Telkomsel (Indonesia)
Africa: MTN and Vodacom (South Africa), MTN (Nigeria)

Every device on current firmware is vulnerable.

Testing Environment

All vulnerability discovery was performed through static firmware analysis using IDA Pro — decompiling ARM binaries and tracing code execution paths from TR-069 parameter input through sprintf into shell execution sinks.

All live hardware verification and proof-of-concept testing was conducted in a private lab environment in Pakistan, on personally owned equipment, using a sysmocom sysmoISIM-SJA5 programmable test SIM (IMSI prefix 999 — ITU reserved test network, not any commercial carrier) on an unoccupied frequency band (Band 7, 2655 MHz — not used by UAE carriers). No live commercial network was affected, no other subscribers' devices were involved, and no transmission was performed on any licensed commercial spectrum.

Repository Contents

advisory/
  TECHNICAL_REPORT.md        Full vulnerability analysis with IDA decompilation
  VENDOR_ADVISORY.md         Formatted vendor notification
  MITRE_CVE_REQUEST.md       CVE record details
  ZTE_PSIRT_EMAIL.md         Record of vendor communication

Verification

1. Extract rootfs from your own X300 device
2. Decompile netcwmpd in IDA Pro or Ghidra
3. Navigate to process_ping at address 0x463A14
4. Trace the Host parameter from TR-069 SetParameterValues through sprintf into the shell command
5. Confirm no input sanitization exists between the network input and system() call

Vendor Response

The manufacturer (Tozed Kangwei) has no Product Security Incident Response Team (PSIRT). All correspondence came from their Global Marketing department. They claimed the vulnerability was "already fixed" but could not provide a CVE number, patched firmware version, or security advisory. No public record of any prior fix exists on NVD, OpenCVE, CVE Details, or the manufacturer's own publications.

Authorization

All research performed on personally owned hardware in a private lab using ITU-reserved test network credentials (MCC 999). No unauthorized access to any system. No live commercial network was affected. Coordinated disclosure in progress.

Researcher

• Name: Muhammad Nadeem Danish
• HackerOne: danish1162
• Bugcrowd: danish1162
• GitHub: danish1162

License

This research is provided for authorized security testing, vendor remediation, and academic research only. Not for unauthorized access or malicious use.