CVE-2026-108576

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...

CVE-2026-108576

A critical OS command injection vulnerability exists in TOZED X300 (versions up to 6.01.3 ). The flaw is located within the process_ping function of the IPPingDiagnostics Handler component. An attacker can achieve remote code execution by manipulating the Host argument. The impact is severe, with...

EUVD-2026-96983

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...

CVE-2026-108576 TOZED X300 IPPingDiagnostics process_ping os command injection

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...

CVE-2026-15891

The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...

CVE-2026-15891

CVE-2026-15891 is a NULL pointer dereference in the Zephyr RTOS MQTT-SN client. The keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c discards the return value of SYS_SLIST_PEEK_HEAD_CONTAINER, leaving the gw pointer as NULL. The code then dereferences gw->gw_id and passes i...

CVE-2026-15891 NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway

The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...

EUVD-2026-77132

The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...

CVE-2026-15891: NULL Pointer Dereference

The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...