ADSLR NBR1005GPEV2 Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the ADSL NBR1005GPEV2 router, specifically in the 250814-r037c version. The issue arises in the 'ap_macfilter_del' function within the '/send_order.cgi' file. This vulnerability allows remote attackers to execute arbitrary commands by manipulating the 'mac' argument, as the application improperly sanitizes input before incorporating it into command executions. The vulnerability has been publicly disclosed, and an exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device, with the executed commands running in the context of the router's operating system.