CVE-2025-35008
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on Microhard BulletLTE-NA2 and IPn4Gii-NA2 devices via the AT+MMNAME command, potentially leading to full system compromise. It affects organizations using these cellular routers/modems for industrial, IoT, or networking applications. Attackers need local access or existing credentials to exploit this issue.
💻 Affected Systems
- Microhard BulletLTE-NA2
- Microhard IPn4Gii-NA2
📦 What is this software?
Bulletlte Na2 Firmware by Microhardcorp
Ipn4gii Na2 Firmware by Microhardcorp
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to install persistent backdoors, intercept network traffic, pivot to internal networks, or use the device as a foothold for further attacks.
Likely Case
Privilege escalation leading to unauthorized configuration changes, service disruption, or data exfiltration from connected systems.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized users from accessing device management interfaces.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once access is obtained. The vulnerability is in the AT command parser, making exploitation relatively simple for attackers with command-line access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
Restart Required: Yes
Instructions:
1. Check vendor advisory for firmware updates. 2. Download latest firmware from Microhard support portal. 3. Follow vendor's firmware update procedures. 4. Verify update completion and restart device.
🔧 Temporary Workarounds
Restrict AT Command Access
allLimit access to device management interfaces and AT command functionality to authorized administrators only.
Network Segmentation
allIsolate affected devices in separate network segments with strict firewall rules preventing unauthorized access.
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from accessing device management interfaces
- Monitor device logs for unusual AT command usage or configuration changes
🔍 How to Verify
Check if Vulnerable:
Check if device responds to AT+MMNAME commands with improper input validation. Requires authenticated access to device console.Check Version:
ATI (check device information) or vendor-specific version command via serial/USB/network interfaceVerify Fix Applied:
Verify firmware version matches patched version from vendor advisory and test that AT+MMNAME command properly sanitizes input.📡 Detection & Monitoring
Log Indicators:
- Unusual AT command sequences
- Multiple failed authentication attempts followed by AT+MMNAME usage
- Unexpected configuration changes
Network Indicators:
- Unusual traffic patterns from device
- Unexpected outbound connections
- AT command traffic from unauthorized sources
SIEM Query:
source="microhard_device" AND (command="AT+MMNAME" OR command="AT*" AND status="success")