CVE-2025-13797
Published: 01 December 2025
Description
A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Performing manipulation of the argument del_swifimac results in command injection. The attack is possible to be carried out remotely. The…
more
exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by validating and sanitizing the del_swifimac parameter in the /send_order.cgi file against malicious inputs.
Requires timely identification, reporting, and correction of the specific command injection flaw in the ADSLR B-QE2W401 250814-r037c firmware.
Monitors and controls remote network traffic to the vulnerable /send_order.cgi endpoint, enabling web application firewall rules to block command injection payloads.
Security SummaryAI
CVE-2025-13797 is a command injection vulnerability in the ADSLR B-QE2W401 250814-r037c device, affecting the parameterdel_swifimac function within the /send_order.cgi file. The issue arises from manipulation of the del_swifimac argument, enabling remote command injection. It is associated with CWE-74 and CWE-77, and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by authenticated users with low privileges, as indicated by the PR:L requirement, with low attack complexity and no need for user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling arbitrary command execution within the context of the affected component.
Advisories detail the issue on VulDB (ctiid.333808, id.333808, submit.691838) and Notion pages, confirming the remote exploitability. The vendor was contacted early about the disclosure but provided no response, and no patches or specific mitigations are referenced.
The exploit is public and may be used, increasing the risk for unpatched ADSLR B-QE2W401 250814-r037c deployments.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in web CGI script (/send_order.cgi) allows remote unauthenticated arbitrary command execution, enabling exploitation of public-facing application (T1190), Unix Shell execution (T1059.004), and indirect command execution (T1202) as noted in advisory.