CVE-2025-13798

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the argument mac can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
ADSLR	NBR1005GPEV2	250814-r037c

References

https://vuldb.com/?ctiid.333809Permissions Required, VDB Entry
https://vuldb.com/?id.333809Third Party Advisory, VDB Entry
https://vuldb.com/?submit.691841Third Party Advisory, VDB Entry
https://www.notion.so/2a60c75766a8805a8973d2ff6a6bcb26Exploit, Third Party Advisory
https://www.notion.so/Report-8-2a60c75766a8805a8973d2ff6a6bcb26Exploit, Third Party Advisory

Timeline

Published: Dec 1, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-137999.8A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /sen CVE-2025-13809.8A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functiona CVE-2025-138009.8A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cg CVE-2025-138017.5The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. T CVE-2025-138024.3A vulnerability was determined in jairiidriss RestaurantWebsite up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. Impacted is an unknown funct CVE-2025-138037.3A vulnerability was identified in MediaCrush 1.0.0/1.0.1. The affected element is an unknown function of the file /mediacrush/paths.py of th CVE-2025-138044.3A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboo CVE-2025-138053.7A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzc CVE-2025-138069.8A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-de CVE-2025-138074.3A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyContro CVE-2025-138088.8A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function u CVE-2025-138096.5A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown