# CVE-2025-13797: ADSLR B-QE2W401 command injection in /send_order.cgi

Source: https://junglewise.ai/threats/cve-2025-13797-adslr-b-qe2w401-command-injection-in-send-order-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13797 · Severity: medium · CVSS 6.3 · Published 2025-12-01

The ADSLR B-QE2W401 is a router device used for broadband connectivity in home and office networks. A command injection vulnerability in the web management interface allows attackers to remotely execute arbitrary system commands by manipulating the del_swifimac parameter, potentially compromising network security and enabling unauthorized access to the device.

Technologies: [Adslr B-Qe2w401](https://junglewise.ai/threats/technologies/b-qe2w401), [Adslr B-Qe2w401 Firmware](https://junglewise.ai/threats/technologies/b-qe2w401-firmware). Vendors: [Adslr](https://junglewise.ai/threats/vendors/adslr).

## Quick answers

**Is CVE-2025-13797 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13797 being exploited in the wild.

**How severe is CVE-2025-13797?** Medium severity, with a CVSS score of 6.3, published 1 December 2025.

**Which products and versions are affected?** Adslr B-Qe2w401 250814-r037c.

**Is there a fix for CVE-2025-13797?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-13797 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-13797?** Check whether you run Adslr B-Qe2w401 or Adslr B-Qe2w401 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a command injection flaw in the parameterdel_swifimac function within /send_order.cgi. An attacker can exploit this by crafting a malicious request with specially crafted input in the del_swifimac parameter, allowing arbitrary command execution on the device without requiring authentication. The attack is network-accessible and exploits insufficient input validation. An attacker can achieve remote code execution with the privileges of the web server, potentially leading to full device compromise, credential theft, or network-level attacks.

## Affected products

- ADSLR B-QE2W401 250814-r037c

## Timeline

- 2025-12-01: disclosed: Publicly disclosed; exploit now available

## References

- [https://vuldb.com/?ctiid.333808](https://vuldb.com/?ctiid.333808)
- [https://vuldb.com/?id.333808](https://vuldb.com/?id.333808)

## Related threats

- [ADSLR NBR1005GPEV2 command injection in ap_macfilter_del](https://junglewise.ai/threats/cve-2025-13799-adslr-nbr1005gpev2-command-injection-in-ap-macfilter-del)
- [A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file…](https://junglewise.ai/threats/cve-2025-13798-a-flaw-has-been-found-in-adslr-nbr1005gpev2-250814-r037c-this)