CVE-2025-35010
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on Microhard BulletLTE-NA2 and IPn4Gii-NA2 devices through improper input validation in the AT+MNPINGTM command. Attackers can escalate privileges and potentially gain full control of affected devices. Organizations using these specific Microhard cellular routers are at risk.
💻 Affected Systems
- Microhard BulletLTE-NA2
- Microhard IPn4Gii-NA2
📦 What is this software?
Bulletlte Na2 Firmware by Microhardcorp
Ipn4gii Na2 Firmware by Microhardcorp
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to reconfigure network settings, intercept traffic, establish persistence, and pivot to internal networks.
Likely Case
Privilege escalation leading to unauthorized administrative access, configuration changes, and potential data interception.
If Mitigated
Limited impact if devices are properly segmented, have strong authentication, and command injection attempts are blocked.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
Restart Required: Yes
Instructions:
1. Monitor vendor advisory for patch release. 2. Download firmware update from Microhard support portal. 3. Apply update following vendor instructions. 4. Reboot device.
🔧 Temporary Workarounds
Restrict AT command access
allLimit access to AT command interface to trusted management networks only
Change default credentials
allEnsure strong, unique passwords are set for all administrative accounts
🧯 If You Can't Patch
- Network segmentation: Isolate affected devices in separate VLANs with strict firewall rules
- Monitor for suspicious AT command usage and authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check if device responds to AT+MNPINGTM command with improper input validationCheck Version:
ATI (check firmware version via serial/console)Verify Fix Applied:
Test if command injection attempts are properly sanitized after update📡 Detection & Monitoring
Log Indicators:
- Unusual AT command sequences
- Multiple failed authentication attempts followed by AT+MNPINGTM usage
- Privilege escalation attempts
Network Indicators:
- Unexpected serial/console traffic to devices
- AT command usage from unauthorized sources
SIEM Query:
source="device_logs" AND (command="AT+MNPINGTM" OR command="AT+" AND contains(arguments, ";"))