CVE-2025-43978: Improper Neutralization of Special Elements used in an OS Command

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...