Vulnerability · Published Dec 1, 2025 · Assigned by VulDB

CVE-2025-13797ADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injection

Medium 6.3

In plain English

A medium-severity command injection in B-QE2W401 from ADSLR. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.2% (higher than 94% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)7.2%top 5.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Performing manipulation of the argument del_swifimac results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
ADSLR	B-QE2W401	250814-r037c

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-333808 | ADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injection vdb-entry, technical-description
VDB-333808 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #691838 | Adslr B-QE2W401 250814-r037c Remote code execution third-party-advisory
https://www.notion.so/2a60c75766a88027a6aec07b378332a8 exploit
https://www.notion.so/report-7-2a60c75766a88027a6aec07b378332a8 exploit