CVE-2025-13800: ADSLR NBR1005GPEV2 send_order.cgi set_mesh_disconnect command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-01 · updated 2026-10-18
Weakness: CWE-74

Description

A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

ADSLR B-QE2W401: through 250814-r037c

References

https://vuldb.com/?ctiid.333811
https://vuldb.com/?id.333811
https://vuldb.com/?submit.691942
https://www.notion.so/2a70c75766a88023aa0ed833ff0239e1

Get alerted when CVE-2025-13800 or the next vulnerability affects your stack