CVE-2025-13799
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on ADSLR NBR1005GPEV2 routers by injecting malicious input into the 'mac' parameter of the ap_macfilter_del function. Attackers can exploit this without authentication to gain control of affected devices. Organizations using these routers are at risk.
💻 Affected Systems
- ADSLR NBR1005GPEV2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router allowing persistent backdoor installation, network traffic interception, lateral movement to internal networks, and device bricking.
Likely Case
Router takeover leading to network disruption, credential theft, and use as attack platform for further intrusions.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploit details are publicly available, making weaponization straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices with supported alternatives.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
linuxUse firewall rules to block external access to /send_order.cgi on affected routers
iptables -A INPUT -p tcp --dport 80 -m string --string "/send_order.cgi" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/send_order.cgi" --algo bm -j DROP
Disable MAC filtering feature
allRemove or disable the MAC filtering functionality if not required
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict access controls
- Implement network monitoring for suspicious traffic to/from router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface or SSH: System > Firmware InformationCheck Version:
curl -s http://router-ip/status.cgi | grep firmwareVerify Fix Applied:
No fix available; verify workarounds by testing blocked access to /send_order.cgi📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /send_order.cgi with shell metacharacters in parameters
- Unexpected command execution in system logs
Network Indicators:
- Suspicious outbound connections from router to unknown IPs
- Unusual traffic patterns from router management interface
SIEM Query:
source="router_logs" AND uri="/send_order.cgi" AND (mac="*;*" OR mac="*|*" OR mac="*`*")