PT-2025-33068 · Unknown · Tuoshi Nr500-Ea+1

Published 2025-08-13 · Updated 2026-01-06 · CVE-2025-43989

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLIC version 3.4.2731.16.43

Description: The /goform/formJsonAjaxReq POST endpoint mishandles the set timesetting action with the ntpserver0 parameter, allowing for arbitrary OS command execution. An unauthenticated attacker can bypass session checks by setting a username=admin cookie and utilizing the ntpserver0 parameter to execute commands.

Recommendations: Versions prior to 3.4.2731.16.43 should be updated. As a temporary workaround, restrict access to the /goform/formJsonAjaxReq endpoint. Avoid using the ntpserver0 parameter in the set timesetting action until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-43989

Affected Products

Rg500Ueaabxcomslic

Tuoshi Nr500-Ea

References · 9

• 🔥 https://github.com/actuator/cve/tree/main/Tuoshi · Exploit
• 🔥 https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2025-43989.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-43989 · Security Note
• https://drive.proton.me/urls/H7J1DPNA00#XrmRLENzyZAp · Note
• https://t.me/CVEtracker/29919 · Telegram Post
• https://twitter.com/CVEnew/status/1955900330648199404 · Twitter Post
• https://twitter.com/ET_Labs/status/2008657708631887990 · Twitter Post
• https://drive.proton.me/urls/QDVK6E2SBR#8LlpbHWzHdmr · Note
• https://twitter.com/VulmonFeeds/status/1955764670846886049 · Twitter Post