EUVD-2025-199941Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CGI injection with PR:L auth; scope change (S:C) and full C/I/A because OS command execution on a router yields complete device control.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in the ADSLR NBR1005GPEV2 router (firmware 250814-r037c) via the mac parameter in the ap_macfilter_del function of /send_order.cgi allows authenticated remote attackers to execute arbitrary OS commands on the device. A public exploit has been disclosed and the vendor was unresponsive to responsible disclosure, leaving the vulnerability unpatched. EPSS sits at 0.41% (61st percentile), suggesting limited mass exploitation activity despite POC availability.
Technical ContextAI
The vulnerability exists in a CGI web management endpoint (/send_order.cgi) responsible for MAC address filter management on the ADSLR NBR1005GPEV2 router. The ap_macfilter_del function passes the user-controlled mac argument directly to an OS-level command without sanitization, a textbook CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) instance that enables shell metacharacter injection. The NVD CPE string references cpe:2.3:o:adslr:b-qe2w401_firmware and the Tags list B Qe2w401 Firmware, which appear to reference a different ADSLR model variant than the NBR1005GPEV2 named in the description - a metadata discrepancy worth verifying. CGI-based command injection is endemic to embedded consumer routers where input validation in web management interfaces is frequently absent.
RemediationAI
No vendor-released patch is available at time of analysis; the vendor was unresponsive to disclosure, and no fix version has been confirmed. The primary compensating control is to restrict network access to the router's web management interface: firewall rules should block all external (WAN-side) access to the HTTP/HTTPS management port, and LAN-side access should be limited to trusted administrator hosts only. If remote management is not required, disable it entirely in the router's configuration. Consider replacing the device with a supported model given the vendor's non-responsiveness. Advisory source: VulDB https://vuldb.com/?id.333810 and EUVD https://nvd.nist.gov/vuln/detail/CVE-2025-13799.
More in B Qe2w401 Firmware
View allCommand injection in ADSLR NBR1005GPEV2 firmware version 250814-r037c allows remote authenticated attackers with low pri
Command injection in ADSLR B-QE2W401 firmware version 250814-r037c allows remote attackers to execute arbitrary commands
Authenticated command injection in ADSLR NBR1005GPEV2 router firmware 250814-r037c allows remote attackers with low priv
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today