CVE-2025-13800mediumCWE-74CWE-77

CVE-2025-13800: medium-severity vulnerability in ADSLR NBR1005GPEV2

ADSLR NBR1005GPEV2 send_order.cgi set_mesh_disconnect command injection

Published

Follow this CVE+ Monitor NBR1005GPEV2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 9.5%
A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
ADSLR · NBR1005GPEV2
Related CVEs — ADSLR NBR1005GPEV2

In the same product, most dangerous first.

CVE-2025-13799MEDIUMADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_del command injectionEPSS 9.5%CVE-2025-13798MEDIUMADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_add command injectionEPSS 7.1%