EIP-2026-101157

This exploit demonstrates an authenticated remote code execution vulnerability in Anevia Flamingo XS 3.6.5. The attacker injects system commands via the `ntp_hosts` parameter in a POST request to `time.php`, achieving root privileges.