PT-2025-48400 · Unknown · Adslr B-Qe2W401

2Er00Ne · Published 2025-12-01 · Updated 2025-12-26 · CVE-2025-13797

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADSLR B-QE2W401 version 250814-r037c

Description A command injection issue exists in ADSLR B-QE2W401 250814-r037c. Manipulation of the del swifimac parameter within the /send order.cgi file can lead to command execution. This attack can be performed remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Restrict or disable the use of the /send order.cgi file. As a temporary workaround, avoid using the del swifimac parameter in the /send order.cgi file until a fix is available.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2025-13797

Affected Products

Adslr B-Qe2W401

References · 14

• 🔥 https://notion.so/2a60c75766a88027a6aec07b378332a8 · Exploit
• 🔥 https://notion.so/report-7-2a60c75766a88027a6aec07b378332a8 · Exploit
• https://osv.dev/vulnerability/CVE-2025-13797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13797 · Security Note
• https://t.me/cveNotify/144355 · Telegram Post
• https://twitter.com/SecAideInfo/status/1996162142287134784 · Twitter Post
• https://vuldb.com/?submit.691838 · Note
• https://vuldb.com/?ctiid.333808 · Note
• https://twitter.com/CVEnew/status/1995332976159473902 · Twitter Post
• https://t.me/CVEtracker/38495 · Telegram Post
• https://twitter.com/SecReportCVE/status/2004617226964419010 · Twitter Post
• https://twitter.com/transilienceai/status/1995334735766192572 · Twitter Post
• https://vuldb.com/?id.333808 · Note
• https://twitter.com/VulmonFeeds/status/1995315167941341392 · Twitter Post