CVE-2025-13798
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on ADSLR NBR1005GPEV2 routers by injecting malicious commands into the 'mac' parameter of the ap_macfilter_add function. Attackers can exploit this flaw without authentication to gain control of affected devices. Organizations using these routers with the vulnerable firmware are at risk.
💻 Affected Systems
- ADSLR NBR1005GPEV2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept network traffic, pivot to internal networks, install persistent backdoors, or use the device for botnet activities.
Likely Case
Attackers gain shell access to the router, enabling them to modify configurations, disrupt network services, or use the device as a foothold for further attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to the router itself without allowing lateral movement to other systems.
🎯 Exploit Status
The exploit has been published and requires minimal technical skill to execute. Attackers can exploit this vulnerability remotely without any authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch is available. Consider the workarounds and mitigation steps below.
🔧 Temporary Workarounds
Disable MAC Filtering Function
allDisable the vulnerable MAC filtering functionality if not required for operations
Access router admin interface > Wireless Settings > MAC Filtering > Disable
Network Segmentation
allIsolate the router from critical internal networks to limit potential damage
🧯 If You Can't Patch
- Replace affected routers with supported models from vendors that provide security updates
- Implement strict network access controls to limit exposure of the router's management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is 250814-r037c, the device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Information pageVerify Fix Applied:
No official fix available to verify. If router is replaced or workarounds implemented, test that MAC filtering functionality is disabled or router is properly segmented.📡 Detection & Monitoring
Log Indicators:
- Unusual commands in router logs
- Multiple failed authentication attempts followed by successful command execution
- Unexpected process execution
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns indicating command and control communication
- Port scanning originating from router
SIEM Query:
source="router_logs" AND ("send_order.cgi" OR "ap_macfilter_add" OR suspicious_command_patterns)