CVE-2025-13800
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on ADSLR NBR1005GPEV2 routers by injecting malicious input into the 'mac' parameter of the set_mesh_disconnect function. Attackers can exploit this without authentication to gain control of affected devices. Organizations using these routers with the vulnerable firmware are at risk.
💻 Affected Systems
- ADSLR NBR1005GPEV2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept traffic, or use the device for botnet activities.
Likely Case
Attackers gain shell access to execute commands, potentially modifying configurations, stealing credentials, or disrupting network services.
If Mitigated
If network segmentation and strict firewall rules are in place, impact may be limited to the router itself without lateral movement.
🎯 Exploit Status
The exploit has been made public according to the disclosure. Command injection vulnerabilities typically have low exploitation complexity when public PoCs exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices or implementing strict network controls.
🔧 Temporary Workarounds
Network Segmentation and Access Control
allIsolate affected routers in a separate VLAN and restrict access to management interfaces
Web Application Firewall Rules
allBlock or sanitize requests to /send_order.cgi containing suspicious patterns in the mac parameter
🧯 If You Can't Patch
- Immediately remove affected devices from internet-facing positions
- Implement strict network monitoring for unusual outbound connections or command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: cat /proc/version or check admin panel. If version is 250814-r037c, device is vulnerable.Check Version:
ssh admin@router-ip 'cat /proc/version' or check web admin interfaceVerify Fix Applied:
No official fix available. Verify workarounds by testing if /send_order.cgi endpoint is inaccessible or properly filtered.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /send_order.cgi with shell metacharacters in parameters
- Unexpected command execution in system logs
- Failed authentication attempts followed by successful command execution
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- Spike in traffic to /send_order.cgi endpoint
- Shell reverse connection attempts from router
SIEM Query:
source="router-logs" AND (uri="/send_order.cgi" AND (param="mac" AND value MATCHES "[;&|`$()]"))