CVE-2025-13799
Published: 01 December 2025
Summary
CVE-2025-13799 is a medium-severity Injection (CWE-74) vulnerability in Adslr B-Qe2W401 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation and error handling of the untrusted 'mac' argument in the /send_order.cgi function.
Mandates timely identification, reporting, and correction of the command injection flaw in the ADSLR NBR1005GPEV2 firmware despite vendor non-response.
Enables vulnerability scanning to identify the publicly disclosed command injection vulnerability (CVE-2025-13799) for subsequent remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in public-facing CGI script (/send_order.cgi) on network device firmware directly enables exploitation of public-facing applications (T1190) and execution of commands via network device CLI (T1059.008).
NVD Description
A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remotely. The exploit has…
more
been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-13799 is a command injection vulnerability affecting the ADSLR NBR1005GPEV2 device on firmware version 250814-r037c. The flaw exists in the ap_macfilter_del function within the /send_order.cgi file, where manipulation of the mac argument enables command injection. Published on 2025-12-01, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is linked to CWE-74 and CWE-77.
The vulnerability allows remote exploitation by attackers possessing low privileges. Upon successful exploitation, adversaries can achieve limited impacts on confidentiality, integrity, and availability, potentially executing arbitrary commands on the affected device.
Advisories note that the vendor was contacted early about the disclosure but provided no response, with no patches or official mitigations available. The exploit has been publicly disclosed via VulDB and may be actively used by attackers.
Details
- CWE(s)