PT-2025-48400 · Unknown · Adslr B-Qe2W401

2Er00Ne · Publicado 2025-12-01 · Atualizado 2025-12-26 · CVE-2025-13797

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADSLR B-QE2W401 version 250814-r037c

Description A command injection issue exists in ADSLR B-QE2W401 250814-r037c. Manipulation of the del swifimac parameter within the /send order.cgi file can lead to command execution. This attack can be performed remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Restrict or disable the use of the /send order.cgi file. As a temporary workaround, avoid using the del swifimac parameter in the /send order.cgi file until a fix is available.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2025-13797

Produtos afetados

Adslr B-Qe2W401

Referências · 14

• 🔥 https://notion.so/2a60c75766a88027a6aec07b378332a8 · Exploit
• 🔥 https://notion.so/report-7-2a60c75766a88027a6aec07b378332a8 · Exploit
• https://osv.dev/vulnerability/CVE-2025-13797 · Aviso do Fabricante
• https://t.me/cveNotify/144355 · Publicação no Telegram
• https://twitter.com/SecAideInfo/status/1996162142287134784 · Publicação no Twitter
• https://vuldb.com/?submit.691838 · Nota
• https://vuldb.com/?ctiid.333808 · Nota
• https://twitter.com/CVEnew/status/1995332976159473902 · Publicação no Twitter
• https://t.me/CVEtracker/38495 · Publicação no Telegram
• https://twitter.com/SecReportCVE/status/2004617226964419010 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1995334735766192572 · Publicação no Twitter
• https://vuldb.com/?id.333808 · Nota
• https://twitter.com/VulmonFeeds/status/1995315167941341392 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-13797 · Nota de Segurança