CVE-2025-13797
📋 TL;DR
This CVE describes a command injection vulnerability in the ADSLR B-QE2W401 device's web interface. Attackers can remotely execute arbitrary commands by manipulating the 'del_swifimac' parameter in the /send_order.cgi endpoint. This affects users of the ADSLR B-QE2W401 device with the vulnerable firmware version.
💻 Affected Systems
- ADSLR B-QE2W401
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, pivot to internal networks, or use device as part of botnet.
Likely Case
Unauthorized command execution leading to device configuration changes, data theft, or denial of service.
If Mitigated
Limited impact if device is isolated from internet and internal networks with strict network segmentation.
🎯 Exploit Status
Exploit details are publicly available. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider workarounds or device replacement.
🔧 Temporary Workarounds
Block Web Interface Access
linuxRestrict access to the device's web management interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable CGI Endpoint
linuxIf possible, disable or restrict access to the vulnerable /send_order.cgi endpoint.
mv /www/cgi-bin/send_order.cgi /www/cgi-bin/send_order.cgi.disabled
🧯 If You Can't Patch
- Isolate device on separate VLAN with no internet access and strict firewall rules.
- Implement network-based intrusion detection to monitor for exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or SSH: cat /etc/version or similar command.Check Version:
cat /etc/version 2>/dev/null || grep -i version /proc/cmdline 2>/dev/nullVerify Fix Applied:
Test if /send_order.cgi endpoint is accessible and responds to malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /send_order.cgi with shell metacharacters
- Commands executed from web process with unusual arguments
Network Indicators:
- HTTP requests containing shell commands in parameters
- Outbound connections from device to unknown IPs
SIEM Query:
source="device_logs" AND url="/send_order.cgi" AND (param="del_swifimac" AND value MATCHES "[;&|`$()]+")