CVE-2026-2035703

**Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)

Tozed ZLT X300 5G CPE firmware 6.01.3 has an unauthenticated TR-069 command injection (CVE-2026-2035703, CVSS 9.8) enabling root code execution.

Full DisclosureSep 8, 17:30 UTC · Sep 8, 2026VulnerabilityCVE-2026-20357032 · 2 reads