Microhard IPn4Gii/Bullet-LTE up to 1.2.0-r1132 AT+MFMAC Command argument injection

Summaryinfo

A vulnerability, which was classified as critical, was found in Microhard IPn4Gii and Bullet-LTE up to 1.2.0-r1132. Affected by this issue is some unknown functionality of the component AT+MFMAC Command Handler. Such manipulation leads to argument injection. This vulnerability is uniquely identified as CVE-2025-35005. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in Microhard IPn4Gii and Bullet-LTE up to 1.2.0-r1132. It has been rated as critical. Affected by this issue is some unknown functionality of the component AT+MFMAC Command Handler. The manipulation with an unknown input leads to a argument injection vulnerability. Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.

The weakness was disclosed by Ricky Lawshae. The advisory is available at takeonme.org. This vulnerability is handled as CVE-2025-35005 since 04/15/2025. The exploitation is known to be easy. Local access is required to approach this attack. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-17403). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Microhard

Name

• Bullet-LTE
• IPn4Gii

Version

• 1.2.0-r1132

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion