CVE-2025-13797: Adslr B-qe2w401 Firmware RCE Vulnerability

CVE-2025-13797 Overview

CVE-2025-13797 is a command injection vulnerability in the ADSLR B-QE2W401 router running firmware version 250814-r037c. The flaw resides in the parameterdel_swifimac function within the /send_order.cgi endpoint. Attackers can manipulate the del_swifimac argument to inject arbitrary operating system commands. The issue is exploitable remotely and requires only low-level privileges. Public exploit details are available, increasing the likelihood of opportunistic abuse. The vendor was contacted before disclosure but did not respond. The vulnerability maps to CWE-77 (Command Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote authenticated attackers can inject operating system commands through the del_swifimac parameter in /send_order.cgi, leading to unauthorized command execution on affected ADSLR devices.

Affected Products

ADSLR B-QE2W401 hardware device
ADSLR B-QE2W401 firmware version 250814-r037c
Deployments exposing the /send_order.cgi management endpoint

Discovery Timeline

2025-12-01 - CVE-2025-13797 published to the National Vulnerability Database (NVD)
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13797

Vulnerability Analysis

The vulnerability exists in the request handler for /send_order.cgi on the ADSLR B-QE2W401 router. The handler exposes a function named parameterdel_swifimac that processes the del_swifimac HTTP parameter without performing sufficient input neutralization. Because the parameter value is passed into a downstream shell or command execution context, an attacker can append shell metacharacters to break out of the intended command and execute arbitrary operating system instructions. The attack is delivered over the network and requires low privileges with no user interaction. Successful exploitation impacts the confidentiality, integrity, and availability of the device, though within a limited scope on the embedded platform.

Root Cause

The root cause is improper neutralization of special elements in a command (CWE-77) and improper input validation propagated to a downstream interpreter (CWE-74). The del_swifimac argument is concatenated into a command string without sanitization or use of safe APIs such as parameterized execution. Shell metacharacters including ;, |, &, and backticks are not filtered, allowing the inserted payload to be parsed by the shell as additional commands.

Attack Vector

The attack vector is network-based against the device's HTTP management interface. An authenticated user with low-privilege access submits a crafted request to /send_order.cgi, supplying a malicious del_swifimac value containing command separators followed by attacker-controlled commands. The injected commands execute in the context of the web service process on the router, which on consumer router firmware typically runs with elevated privileges. The exploit has been disclosed publicly, and no vendor patch is currently available. See the VulDB CTI Report #333808 for additional disclosure details.

Detection Methods for CVE-2025-13797

Indicators of Compromise

HTTP POST or GET requests to /send_order.cgi containing shell metacharacters (;, |, &, `, $()) in the del_swifimac parameter
Unexpected outbound connections from the router to attacker-controlled infrastructure shortly after access to /send_order.cgi
New or modified processes on the router and unexplained changes to firewall, NAT, or DNS configuration

Detection Strategies

Inspect web server and reverse proxy logs for requests targeting /send_order.cgi with non-MAC-address values in del_swifimac
Apply network-based signatures that flag command-injection payloads in HTTP parameters destined for ADSLR management interfaces
Correlate authentication events with subsequent /send_order.cgi requests to identify low-privilege accounts being abused

Monitoring Recommendations

Continuously monitor management plane traffic to embedded network devices and alert on anomalous query strings or POST bodies
Baseline expected administrative actions on the router and alert on deviations such as new outbound sessions originating from the device itself
Capture and retain HTTP transaction logs from the device or upstream gateway for forensic review

How to Mitigate CVE-2025-13797

Immediate Actions Required

Restrict access to the router's web management interface to trusted administrative networks only, blocking exposure to the internet and untrusted LAN segments
Rotate credentials for all accounts capable of authenticating to the device, including low-privileged accounts
Disable or firewall the /send_order.cgi endpoint where supported by the device configuration
Review device logs for prior exploitation attempts against del_swifimac

Patch Information

No vendor patch is currently available. According to the disclosure, the vendor was contacted before publication but did not respond. Organizations should track the VulDB entry for CVE-2025-13797 for updates and consider replacing affected hardware if a fix is not released.

Workarounds

Place affected ADSLR B-QE2W401 devices behind a firewall and permit management access only from a dedicated admin VLAN or jump host
Enforce network segmentation so that the router's management interface is unreachable from user, guest, or IoT networks
Use an upstream web application firewall or IPS to block requests to /send_order.cgi containing shell metacharacters in del_swifimac
Where feasible, replace the device with hardware that receives active vendor security support

bash

# Example upstream firewall rule to restrict management access
# Allow only the admin subnet to reach the router web UI
iptables -A FORWARD -s 10.10.0.0/24 -d <router_ip> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP