Which versions of B Qe2w401 Firmware are affected by CVE-2025-13797?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-13797, a injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2025-13797?

Yes, a public proof-of-concept exploit is available for CVE-2025-13797. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-13797?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

B Qe2w401 Firmware CVE-2025-13797

Q: What is the CVSS score of CVE-2025-13797?

CVE-2025-13797 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2025-199944 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-01 cna@vuldb.com

Command Injection B Qe2w401 Firmware Adslr

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-199944

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

PoC Detected

Dec 11, 2025 - 23:06 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 01:16 nvd

MEDIUM 6.3

CVE Published

Dec 01, 2025 - 01:16 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Performing manipulation of the argument del_swifimac results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in ADSLR B-QE2W401 firmware version 250814-r037c allows remote attackers to execute arbitrary commands via the del_swifimac parameter in the /send_order.cgi endpoint. Exploit code is publicly available; no active exploitation (CISA KEV) is reported, though the EPSS likelihood of exploitation is at the 68th percentile (0.56%). The vendor has not responded to disclosure.