CVE-2025-13798

MEDIUM

ADSLR NBR1005GPEV2 < 250814-r037c - Remote Command Injection via send_order.cgi mac Parameter

Title source: llm
STIX 2.1

Description

A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the argument mac can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.333809
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.333809
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.691841
Exploit, Third Party Advisory exploit
https://www.notion.so/2a60c75766a8805a8973d2ff6a6bcb26

Scores

CVSS v3 6.3
EPSS 0.0634
EPSS Percentile 92.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (1)
adslr/b-qe2w401_firmware < 250814-r037c
Published Dec 01, 2025
Tracked Since Feb 18, 2026