CVE-2025-13799
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, potentially leading to takeover of the device and compromise of network integrity.
Recommendation
Apply available patches or restrict access to /send_order.cgi to trusted networks only. If the vendor does not release a patch, consider disabling or replacing the device.
Other vulnerabilities in ADSLR NBR1005GPEV2
Original NVD description (English source)
A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.