CVE-2025-35005 - CVE House

Back to Database

Status published High CVE-2025-35005

Microhard Bullet-LTE and IPn4Gii AT+MFMAC Argument Injection

7.1 CVSS

Vulnerability Description

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-35005

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Ricky "HeadlessZeke" Lawshae of Keysight
todb

References

More from Microhard

View All →

Microhard Bullet-LTE and IPn4Gii AT+MNPINGTM Argument Injection

Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection

Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection

Microhard Bullet-LTE and IPn4Gii AT+MFRULE Argument Injection

Microhard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument Injection

Affected Vendor

Microhard

View all reports →

Affected Software

IPn4Gii / Bullet-LTE Firmware

Vulnerable Versions:

0

Timeline

Official Publish: June 8th, 2025

Last Modified: June 9th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation