FKIE_CVE-2025-43989

Vulnerability from fkie_nvd - Published: 2025-08-13 19:15 - Updated: 2026-06-17 09:24
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Summary
The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can use that parameter to execute arbitrary OS commands.
References
cve@mitre.orghttps://drive.proton.me/urls/H7J1DPNA00#XrmRLENzyZAp
cve@mitre.orghttps://drive.proton.me/urls/QDVK6E2SBR#8LlpbHWzHdmr
cve@mitre.orghttps://github.com/actuator/cve/blob/main/Tuoshi/CVE-2025-43989.txt
cve@mitre.orghttps://github.com/actuator/cve/tree/main/Tuoshi
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can use that parameter to execute arbitrary OS commands."
    },
    {
      "lang": "es",
      "value": "El endpoint POST /goform/formJsonAjaxReq de los dispositivos Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 gestiona incorrectamente la acci\u00f3n set_timesetting con el par\u00e1metro ntpserver0, que se utiliza en un comando del sistema. Al establecer una cookie `username=admin` (omitiendo las comprobaciones de sesi\u00f3n normales), un atacante no autenticado puede usar ese par\u00e1metro para ejecutar comandos arbitrarios del sistema operativo."
    }
  ],
  "id": "CVE-2025-43989",
  "lastModified": "2026-06-17T09:24:52.847",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-43989",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-08-13T20:30:00.474609Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-08-13T19:15:28.633",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://drive.proton.me/urls/H7J1DPNA00#XrmRLENzyZAp"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://drive.proton.me/urls/QDVK6E2SBR#8LlpbHWzHdmr"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2025-43989.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/actuator/cve/tree/main/Tuoshi"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.