CVE-2025-13800
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
An attacker can remotely execute arbitrary commands on the device, potentially leading to full compromise of the device and the network it resides in.
Recommendation
Apply available patches or restrict access to /send_order.cgi to trusted networks only. If the vendor does not release a patch, consider disabling or replacing the device.
Other vulnerabilities in ADSLR NBR1005GPEV2
Original NVD description (English source)
A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.