CVE-2025-35006
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on Microhard BulletLTE-NA2 and IPn4Gii-NA2 devices via command injection in the AT+MFPORTFWD command. Successful exploitation leads to privilege escalation, potentially giving attackers full control of affected devices. Organizations using these specific Microhard cellular routers are affected.
💻 Affected Systems
- Microhard BulletLTE-NA2
- Microhard IPn4Gii-NA2
📦 What is this software?
Bulletlte Na2 Firmware by Microhardcorp
Ipn4gii Na2 Firmware by Microhardcorp
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to reconfigure network settings, intercept traffic, establish persistence, and pivot to internal networks.
Likely Case
Local privilege escalation enabling attackers to modify device configurations, disable security features, or install backdoors.
If Mitigated
Limited impact if devices are properly segmented, have strong authentication controls, and command injection attempts are blocked.
🎯 Exploit Status
Exploitation requires authentication but command injection is straightforward once authenticated. No public exploit code identified at time of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
Restart Required: Yes
Instructions:
1. Monitor vendor advisory for firmware updates. 2. Download firmware from Microhard support portal. 3. Follow vendor's firmware update procedure. 4. Verify update applied successfully.
🔧 Temporary Workarounds
Restrict AT Command Access
allLimit access to device management interface and AT commands to authorized administrators only
Network Segmentation
allIsolate affected devices in separate network segments to limit potential lateral movement
🧯 If You Can't Patch
- Implement strict access controls to device management interfaces
- Monitor for suspicious AT command usage and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if device responds to AT+MFPORTFWD command with improper input validation. Requires authenticated access to test.Check Version:
ATI (check firmware version via AT command interface)Verify Fix Applied:
Verify firmware version matches patched version from vendor advisory and test command injection no longer works.📡 Detection & Monitoring
Log Indicators:
- Unusual AT command sequences
- Multiple failed authentication attempts followed by AT+MFPORTFWD usage
- Privilege escalation attempts
Network Indicators:
- Unusual outbound connections from affected devices
- AT command traffic to unexpected destinations
SIEM Query:
Search for 'AT+MFPORTFWD' in device logs or authentication logs showing successful login followed by command injection patterns