B Qe2w401 Firmware
Monthly
Authenticated command injection in ADSLR NBR1005GPEV2 router firmware 250814-r037c allows remote attackers with low privileges to execute arbitrary OS commands via the mac parameter in /send_order.cgi. Exploit code is publicly available, though no active exploitation has been reported. The vulnerability scores only 2.1 in CVSS 4.0 due to limited impact.
Command injection in the ADSLR NBR1005GPEV2 router (firmware 250814-r037c) via the `mac` parameter in the `ap_macfilter_del` function of `/send_order.cgi` allows authenticated remote attackers to execute arbitrary OS commands on the device. A public exploit has been disclosed and the vendor was unresponsive to responsible disclosure, leaving the vulnerability unpatched. EPSS sits at 0.41% (61st percentile), suggesting limited mass exploitation activity despite POC availability.
Command injection in ADSLR NBR1005GPEV2 firmware version 250814-r037c allows remote authenticated attackers with low privileges to execute arbitrary commands via the mac parameter in the ap_macfilter_add function of /send_order.cgi. Exploit code is publicly available, though the EPSS exploitation probability is low (0.56%) and the vulnerability has not been cataloged in CISA KEV. The vendor has not responded, leaving no official patch.
Command injection in ADSLR B-QE2W401 firmware version 250814-r037c allows remote attackers to execute arbitrary commands via the `del_swifimac` parameter in the `/send_order.cgi` endpoint. Exploit code is publicly available; no active exploitation (CISA KEV) is reported, though the EPSS likelihood of exploitation is at the 68th percentile (0.56%). The vendor has not responded to disclosure.
Authenticated command injection in ADSLR NBR1005GPEV2 router firmware 250814-r037c allows remote attackers with low privileges to execute arbitrary OS commands via the mac parameter in /send_order.cgi. Exploit code is publicly available, though no active exploitation has been reported. The vulnerability scores only 2.1 in CVSS 4.0 due to limited impact.
Command injection in the ADSLR NBR1005GPEV2 router (firmware 250814-r037c) via the `mac` parameter in the `ap_macfilter_del` function of `/send_order.cgi` allows authenticated remote attackers to execute arbitrary OS commands on the device. A public exploit has been disclosed and the vendor was unresponsive to responsible disclosure, leaving the vulnerability unpatched. EPSS sits at 0.41% (61st percentile), suggesting limited mass exploitation activity despite POC availability.
Command injection in ADSLR NBR1005GPEV2 firmware version 250814-r037c allows remote authenticated attackers with low privileges to execute arbitrary commands via the mac parameter in the ap_macfilter_add function of /send_order.cgi. Exploit code is publicly available, though the EPSS exploitation probability is low (0.56%) and the vulnerability has not been cataloged in CISA KEV. The vendor has not responded, leaving no official patch.
Command injection in ADSLR B-QE2W401 firmware version 250814-r037c allows remote attackers to execute arbitrary commands via the `del_swifimac` parameter in the `/send_order.cgi` endpoint. Exploit code is publicly available; no active exploitation (CISA KEV) is reported, though the EPSS likelihood of exploitation is at the 68th percentile (0.56%). The vendor has not responded to disclosure.