CVE-2025-13800: Adslr B-qe2w401 Firmware RCE Vulnerability

CVE-2025-13800 Overview

A command injection vulnerability has been identified in the ADSLR NBR1005GPEV2 network device running firmware version 250814-r037c. The vulnerability exists within the set_mesh_disconnect function located in the /send_order.cgi file. Improper handling of the mac parameter allows attackers to inject arbitrary operating system commands that are executed by the underlying system.

Critical Impact

Remote attackers with low privileges can exploit this command injection vulnerability to execute arbitrary commands on affected ADSLR network devices, potentially leading to complete device compromise, network pivoting, or establishment of persistent backdoor access.

Affected Products

• ADSLR B-QE2W401 Firmware
• ADSLR B-QE2W401 Hardware
• ADSLR NBR1005GPEV2 (Firmware version 250814-r037c)

Discovery Timeline

• December 1, 2025 - CVE-2025-13800 published to NVD
• December 11, 2025 - Last updated in NVD database

Technical Details for CVE-2025-13800

Vulnerability Analysis

This command injection vulnerability (CWE-74: Injection) resides in the web management interface of ADSLR NBR1005GPEV2 devices. The set_mesh_disconnect function within /send_order.cgi fails to properly sanitize user-supplied input in the mac parameter before incorporating it into system commands.

When an authenticated attacker submits a malicious mac parameter value containing shell metacharacters, the unsanitized input is passed directly to the underlying operating system shell. This allows for the execution of arbitrary commands with the privileges of the web server process, which on embedded devices like routers typically runs with elevated system privileges.

The network-based attack vector enables exploitation from remote locations without requiring physical access to the device. The vendor was contacted about this vulnerability but did not respond, leaving users without an official patch or mitigation guidance.

Root Cause

The root cause stems from improper input validation and sanitization in the set_mesh_disconnect function. The mac parameter, which should only accept MAC address values in a specific format (e.g., XX:XX:XX:XX:XX:XX), does not validate or sanitize input before passing it to shell commands. This lack of input validation allows shell metacharacters such as semicolons (;), pipes (|), backticks, and command substitution syntax ($(...)) to be interpreted by the system shell.

Attack Vector

The attack can be executed remotely over the network by any authenticated user with access to the device's web management interface. An attacker can craft a malicious HTTP request to /send_order.cgi that includes command injection payloads within the mac parameter.

The exploitation flow involves:

1. Authenticating to the device's web interface (requires low privilege access)
2. Sending a crafted request to /send_order.cgi with the set_mesh_disconnect function
3. Including shell metacharacters and commands within the mac parameter
4. The backend executes the injected commands with the web server's privileges

A typical attack payload would append shell commands after a valid or malformed MAC address using characters like ;, |, or && to chain additional commands.

Detection Methods for CVE-2025-13800

Indicators of Compromise

• Unusual HTTP requests to /send_order.cgi containing shell metacharacters in parameters
• Unexpected outbound connections from the network device to external IP addresses
• Modified system files or configurations on the affected device
• Presence of unauthorized user accounts or SSH keys on the device
• Anomalous processes running on the device that are not part of normal operations

Detection Strategies

• Monitor web access logs for requests to /send_order.cgi containing suspicious characters such as ;, |, $(, or backticks in the mac parameter
• Implement network intrusion detection rules to identify command injection patterns in HTTP traffic destined for ADSLR devices
• Deploy web application firewall (WAF) rules to block requests containing shell metacharacters in form parameters
• Use endpoint detection solutions to monitor for unusual process spawning from the web server process

Monitoring Recommendations

• Enable verbose logging on ADSLR devices if supported and forward logs to a centralized SIEM
• Monitor network traffic for unexpected DNS queries or reverse shell connections originating from network infrastructure devices
• Implement network segmentation to isolate IoT and network devices from critical infrastructure
• Regularly audit device configurations for unauthorized changes

How to Mitigate CVE-2025-13800

Immediate Actions Required

• Restrict access to the device's web management interface to trusted administrative networks only
• Implement strong network segmentation to limit exposure of vulnerable devices
• Deploy web application firewall rules to filter malicious input to /send_order.cgi
• Monitor the device for signs of compromise and unusual activity
• Consider replacing affected devices with alternatives from vendors with responsive security practices

Patch Information

No official patch is currently available from the vendor. According to the vulnerability disclosure, ADSLR was contacted about this vulnerability but did not respond. Organizations should monitor vendor communications and security advisories for potential future patches. Additional technical details are available through VulDB #333811.

Workarounds

• Disable remote management access to the device's web interface if not required for operations
• Implement access control lists (ACLs) to restrict which IP addresses can reach the management interface
• Place the device behind a reverse proxy that can filter malicious input patterns
• Use a VPN to access the management interface rather than exposing it directly to the network
• Consider network-level filtering to block HTTP requests containing command injection patterns

# Example: Restrict management interface access via firewall rules
# Block external access to the vulnerable CGI endpoint
iptables -A INPUT -p tcp --dport 80 -s !192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s !192.168.1.0/24 -j DROP

# Allow only specific management IPs
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP