CVE-2025-43989

MEDIUM EPSS 92.1%
Published Aug 13, 202510mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Aug 13, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can use that parameter to execute arbitrary OS commands.

CVSS Details

Base Score
6.5
Exploitability
2.2
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
92.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

References 4

  • drive.proton.me https://drive.proton.me/urls/H7J1DPNA00#XrmRLENzyZAp
  • drive.proton.me https://drive.proton.me/urls/QDVK6E2SBR#8LlpbHWzHdmr
  • github.com https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2025-43989.txt
  • github.com https://github.com/actuator/cve/tree/main/Tuoshi

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.