Microhard IPn4Gii/Bullet-LTE up to 1.2.0-r1132 AT+MFPORTFWD Command argument injection

Summaryinfo

A vulnerability has been found in Microhard IPn4Gii and Bullet-LTE up to 1.2.0-r1132 and classified as critical. This affects an unknown part of the component AT+MFPORTFWD Command Handler. Performing a manipulation results in argument injection. This vulnerability was named CVE-2025-35006. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in Microhard IPn4Gii and Bullet-LTE up to 1.2.0-r1132. This affects an unknown part of the component AT+MFPORTFWD Command Handler. The manipulation with an unknown input leads to a argument injection vulnerability. CWE is classifying the issue as CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.

The weakness was presented by Ricky Lawshae. It is possible to read the advisory at takeonme.org. This vulnerability is uniquely identified as CVE-2025-35006 since 04/15/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-17402). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Microhard

Name

• Bullet-LTE
• IPn4Gii

Version

• 1.2.0-r1132

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion