CVE-2025-43989

The Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLIC wireless router (version 3.4.2731.16.43 ) is vulnerable to OS command injection via the /goform/formJsonAjaxReq POST endpoint. The flaw exists because the set_timesetting action fails to properly neutralize the ntpserver0 parameter, which is utilize...