Search criteria
21 vulnerabilities found for bulletlte-na2_firmware by microhardcorp
CVE-2025-35007 (GCVE-0-2025-35007)
Vulnerability from nvd – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:18
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MFRULE Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35007",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:18:45.423248Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:18:53.105Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:38.698Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35007/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MFRULE Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35007",
"datePublished": "2025-06-08T21:05:38.698Z",
"dateReserved": "2025-04-15T20:40:30.571Z",
"dateUpdated": "2025-06-09T03:18:53.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35009 (GCVE-0-2025-35009)
Vulnerability from nvd – Published: 2025-06-08 21:06 – Updated: 2025-06-09 03:17
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35009",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:16:59.379120Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:17:10.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:06:05.426Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35009/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35009",
"datePublished": "2025-06-08T21:06:05.426Z",
"dateReserved": "2025-04-15T20:40:30.572Z",
"dateUpdated": "2025-06-09T03:17:10.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35010 (GCVE-0-2025-35010)
Vulnerability from nvd – Published: 2025-06-08 21:06 – Updated: 2025-06-09 03:16
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MNPINGTM Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35010",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:15:50.314272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:16:04.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:06:16.368Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35010/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MNPINGTM Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35010",
"datePublished": "2025-06-08T21:06:16.368Z",
"dateReserved": "2025-04-15T20:40:30.572Z",
"dateUpdated": "2025-06-09T03:16:04.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35006 (GCVE-0-2025-35006)
Vulnerability from nvd – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:19
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35006",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:19:38.062525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:19:46.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:25.706Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35006/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35006",
"datePublished": "2025-06-08T21:05:25.706Z",
"dateReserved": "2025-04-15T20:40:30.571Z",
"dateUpdated": "2025-06-09T03:19:46.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35008 (GCVE-0-2025-35008)
Vulnerability from nvd – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:18
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35008",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:17:45.431505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:18:02.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:52.090Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35008/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35008",
"datePublished": "2025-06-08T21:05:52.090Z",
"dateReserved": "2025-04-15T20:40:30.572Z",
"dateUpdated": "2025-06-09T03:18:02.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35005 (GCVE-0-2025-35005)
Vulnerability from nvd – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:20
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MFMAC Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35005",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:20:43.281393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:20:54.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:15.936Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35005/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MFMAC Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35005",
"datePublished": "2025-06-08T21:05:15.936Z",
"dateReserved": "2025-04-15T20:40:30.571Z",
"dateUpdated": "2025-06-09T03:20:54.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35004 (GCVE-0-2025-35004)
Vulnerability from nvd – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:22
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MFIP Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35004",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:22:06.240054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:22:14.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:01.219Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35004/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MFIP Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35004",
"datePublished": "2025-06-08T21:05:01.219Z",
"dateReserved": "2025-04-15T20:40:30.571Z",
"dateUpdated": "2025-06-09T03:22:14.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
FKIE_CVE-2025-35008
Vulnerability from fkie_nvd - Published: 2025-06-08 21:15 - Updated: 2026-01-12 16:54
Severity ?
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
References
| URL | Tags | ||
|---|---|---|---|
| cve@takeonme.org | https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware | Permissions Required | |
| cve@takeonme.org | https://takeonme.org/cves/cve-2025-35008/ | Exploit, Third Party Advisory | |
| cve@takeonme.org | https://www.microhardcorp.com/BulletLTE-NA2.php | Product | |
| cve@takeonme.org | https://www.microhardcorp.com/IPn4Gii-NA2.php | Product |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microhardcorp | ipn4gii-na2_firmware | * | |
| microhardcorp | ipn4gii-na2 | - | |
| microhardcorp | bulletlte-na2_firmware | * | |
| microhardcorp | bulletlte-na2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:ipn4gii-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B0A7633-8E29-4761-94D7-656C67A72FC6",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:ipn4gii-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D8B1631-C059-48E8-BA76-BDCBD1087DCE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:bulletlte-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "09CD4AAD-FA35-4D4B-B7E9-C8A432C4DA44",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:bulletlte-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AD0782-1211-4965-91C9-3E0B990DB5DA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
},
{
"lang": "es",
"value": "Los productos que incorporan Microhard BulletLTE-NA2 e IPn4Gii-NA2 son vulnerables a un problema de inyecci\u00f3n de comandos posterior a la autenticaci\u00f3n en el comando AT+MMNAME, que puede provocar una escalada de privilegios. Se trata de una instancia de CWE-88, \"Neutralizaci\u00f3n incorrecta de delimitadores de argumentos en un comando (\u0027Inyecci\u00f3n de argumentos\u0027)\", y se estima como CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Este problema no se hab\u00eda solucionado en general al momento de la primera publicaci\u00f3n de este registro CVE."
}
],
"id": "CVE-2025-35008",
"lastModified": "2026-01-12T16:54:57.603",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
},
"published": "2025-06-08T21:15:32.363",
"references": [
{
"source": "cve@takeonme.org",
"tags": [
"Permissions Required"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"source": "cve@takeonme.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35008/"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"sourceIdentifier": "cve@takeonme.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-88"
}
],
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-35006
Vulnerability from fkie_nvd - Published: 2025-06-08 21:15 - Updated: 2026-01-12 16:54
Severity ?
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
References
| URL | Tags | ||
|---|---|---|---|
| cve@takeonme.org | https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware | Permissions Required | |
| cve@takeonme.org | https://takeonme.org/cves/cve-2025-35006/ | Exploit, Third Party Advisory | |
| cve@takeonme.org | https://www.microhardcorp.com/BulletLTE-NA2.php | Product | |
| cve@takeonme.org | https://www.microhardcorp.com/IPn4Gii-NA2.php | Product |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microhardcorp | ipn4gii-na2_firmware | * | |
| microhardcorp | ipn4gii-na2 | - | |
| microhardcorp | bulletlte-na2_firmware | * | |
| microhardcorp | bulletlte-na2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:ipn4gii-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B0A7633-8E29-4761-94D7-656C67A72FC6",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:ipn4gii-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D8B1631-C059-48E8-BA76-BDCBD1087DCE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:bulletlte-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "09CD4AAD-FA35-4D4B-B7E9-C8A432C4DA44",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:bulletlte-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AD0782-1211-4965-91C9-3E0B990DB5DA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
},
{
"lang": "es",
"value": "Los productos que incorporan Microhard BulletLTE-NA2 e IPn4Gii-NA2 son vulnerables a un problema de inyecci\u00f3n de comandos posterior a la autenticaci\u00f3n en el comando AT+MFPORTFWD, que puede provocar una escalada de privilegios. Se trata de una instancia de CWE-88, \"Neutralizaci\u00f3n incorrecta de delimitadores de argumentos en un comando (\u0027Inyecci\u00f3n de argumentos\u0027)\", y se estima como CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Este problema no se hab\u00eda solucionado en general al momento de la primera publicaci\u00f3n de este registro CVE."
}
],
"id": "CVE-2025-35006",
"lastModified": "2026-01-12T16:54:46.893",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
},
"published": "2025-06-08T21:15:32.087",
"references": [
{
"source": "cve@takeonme.org",
"tags": [
"Permissions Required"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"source": "cve@takeonme.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35006/"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"sourceIdentifier": "cve@takeonme.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-88"
}
],
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-35007
Vulnerability from fkie_nvd - Published: 2025-06-08 21:15 - Updated: 2026-01-12 16:54
Severity ?
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
References
| URL | Tags | ||
|---|---|---|---|
| cve@takeonme.org | https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware | Permissions Required | |
| cve@takeonme.org | https://takeonme.org/cves/cve-2025-35007/ | Exploit, Third Party Advisory | |
| cve@takeonme.org | https://www.microhardcorp.com/BulletLTE-NA2.php | Product | |
| cve@takeonme.org | https://www.microhardcorp.com/IPn4Gii-NA2.php | Product |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microhardcorp | ipn4gii-na2_firmware | * | |
| microhardcorp | ipn4gii-na2 | - | |
| microhardcorp | bulletlte-na2_firmware | * | |
| microhardcorp | bulletlte-na2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:ipn4gii-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B0A7633-8E29-4761-94D7-656C67A72FC6",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:ipn4gii-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D8B1631-C059-48E8-BA76-BDCBD1087DCE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:bulletlte-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "09CD4AAD-FA35-4D4B-B7E9-C8A432C4DA44",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:bulletlte-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AD0782-1211-4965-91C9-3E0B990DB5DA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
},
{
"lang": "es",
"value": "Los productos que incorporan Microhard BulletLTE-NA2 e IPn4Gii-NA2 son vulnerables a un problema de inyecci\u00f3n de comandos posterior a la autenticaci\u00f3n en el comando AT+MFRULE, que puede provocar una escalada de privilegios. Se trata de una instancia de CWE-88, \"Neutralizaci\u00f3n incorrecta de delimitadores de argumentos en un comando (\u0027Inyecci\u00f3n de argumentos\u0027)\", y se estima como CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Este problema no se hab\u00eda solucionado en general al momento de la primera publicaci\u00f3n de este registro CVE."
}
],
"id": "CVE-2025-35007",
"lastModified": "2026-01-12T16:54:54.490",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
},
"published": "2025-06-08T21:15:32.227",
"references": [
{
"source": "cve@takeonme.org",
"tags": [
"Permissions Required"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"source": "cve@takeonme.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35007/"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"sourceIdentifier": "cve@takeonme.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-88"
}
],
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-35010
Vulnerability from fkie_nvd - Published: 2025-06-08 21:15 - Updated: 2026-01-12 16:55
Severity ?
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
References
| URL | Tags | ||
|---|---|---|---|
| cve@takeonme.org | https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware | Permissions Required | |
| cve@takeonme.org | https://takeonme.org/cves/cve-2025-35010/ | Exploit, Third Party Advisory | |
| cve@takeonme.org | https://www.microhardcorp.com/BulletLTE-NA2.php | Product | |
| cve@takeonme.org | https://www.microhardcorp.com/IPn4Gii-NA2.php | Product |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microhardcorp | ipn4gii-na2_firmware | * | |
| microhardcorp | ipn4gii-na2 | - | |
| microhardcorp | bulletlte-na2_firmware | * | |
| microhardcorp | bulletlte-na2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:ipn4gii-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B0A7633-8E29-4761-94D7-656C67A72FC6",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:ipn4gii-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D8B1631-C059-48E8-BA76-BDCBD1087DCE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:bulletlte-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "09CD4AAD-FA35-4D4B-B7E9-C8A432C4DA44",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:bulletlte-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AD0782-1211-4965-91C9-3E0B990DB5DA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
},
{
"lang": "es",
"value": "Los productos que incorporan Microhard BulletLTE-NA2 e IPn4Gii-NA2 son vulnerables a un problema de inyecci\u00f3n de comandos posterior a la autenticaci\u00f3n en el comando AT+MNPINGTM, que puede provocar una escalada de privilegios. Se trata de una instancia de CWE-88, \"Neutralizaci\u00f3n incorrecta de delimitadores de argumentos en un comando (\u0027Inyecci\u00f3n de argumentos\u0027)\", y se estima como CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Este problema no se hab\u00eda solucionado en general al momento de la primera publicaci\u00f3n de este registro CVE."
}
],
"id": "CVE-2025-35010",
"lastModified": "2026-01-12T16:55:05.630",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
},
"published": "2025-06-08T21:15:32.633",
"references": [
{
"source": "cve@takeonme.org",
"tags": [
"Permissions Required"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"source": "cve@takeonme.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35010/"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"sourceIdentifier": "cve@takeonme.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-88"
}
],
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-35009
Vulnerability from fkie_nvd - Published: 2025-06-08 21:15 - Updated: 2026-01-12 16:55
Severity ?
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
References
| URL | Tags | ||
|---|---|---|---|
| cve@takeonme.org | https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware | Permissions Required | |
| cve@takeonme.org | https://takeonme.org/cves/cve-2025-35009/ | Exploit, Third Party Advisory | |
| cve@takeonme.org | https://www.microhardcorp.com/BulletLTE-NA2.php | Product | |
| cve@takeonme.org | https://www.microhardcorp.com/IPn4Gii-NA2.php | Product |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microhardcorp | ipn4gii-na2_firmware | * | |
| microhardcorp | ipn4gii-na2 | - | |
| microhardcorp | bulletlte-na2_firmware | * | |
| microhardcorp | bulletlte-na2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:ipn4gii-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B0A7633-8E29-4761-94D7-656C67A72FC6",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:ipn4gii-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D8B1631-C059-48E8-BA76-BDCBD1087DCE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:bulletlte-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "09CD4AAD-FA35-4D4B-B7E9-C8A432C4DA44",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:bulletlte-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AD0782-1211-4965-91C9-3E0B990DB5DA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
},
{
"lang": "es",
"value": "Los productos que incorporan Microhard BulletLTE-NA2 e IPn4Gii-NA2 son vulnerables a un problema de inyecci\u00f3n de comandos posterior a la autenticaci\u00f3n en el comando AT+MNNETSP, que puede provocar una escalada de privilegios. Se trata de una instancia de CWE-88, \"Neutralizaci\u00f3n incorrecta de delimitadores de argumentos en un comando (\u0027Inyecci\u00f3n de argumentos\u0027)\", y se estima como CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Este problema no se hab\u00eda solucionado en general al momento de la primera publicaci\u00f3n de este registro CVE."
}
],
"id": "CVE-2025-35009",
"lastModified": "2026-01-12T16:55:01.207",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
},
"published": "2025-06-08T21:15:32.500",
"references": [
{
"source": "cve@takeonme.org",
"tags": [
"Permissions Required"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"source": "cve@takeonme.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35009/"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"sourceIdentifier": "cve@takeonme.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-88"
}
],
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-35005
Vulnerability from fkie_nvd - Published: 2025-06-08 21:15 - Updated: 2026-01-12 16:54
Severity ?
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
References
| URL | Tags | ||
|---|---|---|---|
| cve@takeonme.org | https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware | Permissions Required | |
| cve@takeonme.org | https://takeonme.org/cves/cve-2025-35005/ | Exploit, Third Party Advisory | |
| cve@takeonme.org | https://www.microhardcorp.com/BulletLTE-NA2.php | Product | |
| cve@takeonme.org | https://www.microhardcorp.com/IPn4Gii-NA2.php | Product |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microhardcorp | ipn4gii-na2_firmware | * | |
| microhardcorp | ipn4gii-na2 | - | |
| microhardcorp | bulletlte-na2_firmware | * | |
| microhardcorp | bulletlte-na2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:ipn4gii-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B0A7633-8E29-4761-94D7-656C67A72FC6",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:ipn4gii-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D8B1631-C059-48E8-BA76-BDCBD1087DCE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:bulletlte-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "09CD4AAD-FA35-4D4B-B7E9-C8A432C4DA44",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:bulletlte-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AD0782-1211-4965-91C9-3E0B990DB5DA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
},
{
"lang": "es",
"value": "Los productos que incorporan Microhard BulletLTE-NA2 e IPn4Gii-NA2 son vulnerables a un problema de inyecci\u00f3n de comandos posterior a la autenticaci\u00f3n en el comando AT+MFMAC, que puede provocar una escalada de privilegios. Se trata de una instancia de CWE-88, \"Neutralizaci\u00f3n incorrecta de delimitadores de argumentos en un comando (\u0027Inyecci\u00f3n de argumentos\u0027)\", y se estima como CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Este problema no se hab\u00eda solucionado en general al momento de la primera publicaci\u00f3n de este registro CVE."
}
],
"id": "CVE-2025-35005",
"lastModified": "2026-01-12T16:54:39.903",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
},
"published": "2025-06-08T21:15:31.947",
"references": [
{
"source": "cve@takeonme.org",
"tags": [
"Permissions Required"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"source": "cve@takeonme.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35005/"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"sourceIdentifier": "cve@takeonme.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-88"
}
],
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-35004
Vulnerability from fkie_nvd - Published: 2025-06-08 21:15 - Updated: 2026-01-12 16:54
Severity ?
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
References
| URL | Tags | ||
|---|---|---|---|
| cve@takeonme.org | https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware | Permissions Required | |
| cve@takeonme.org | https://takeonme.org/cves/cve-2025-35004/ | Exploit, Third Party Advisory | |
| cve@takeonme.org | https://www.microhardcorp.com/BulletLTE-NA2.php | Product | |
| cve@takeonme.org | https://www.microhardcorp.com/IPn4Gii-NA2.php | Product |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microhardcorp | ipn4gii-na2_firmware | * | |
| microhardcorp | ipn4gii-na2 | - | |
| microhardcorp | bulletlte-na2_firmware | * | |
| microhardcorp | bulletlte-na2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:ipn4gii-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B0A7633-8E29-4761-94D7-656C67A72FC6",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:ipn4gii-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D8B1631-C059-48E8-BA76-BDCBD1087DCE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microhardcorp:bulletlte-na2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "09CD4AAD-FA35-4D4B-B7E9-C8A432C4DA44",
"versionEndIncluding": "1.2.0-r1132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:microhardcorp:bulletlte-na2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66AD0782-1211-4965-91C9-3E0B990DB5DA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
},
{
"lang": "es",
"value": "Los productos que incorporan Microhard BulletLTE-NA2 e IPn4Gii-NA2 son vulnerables a un problema de inyecci\u00f3n de comandos posterior a la autenticaci\u00f3n en el comando AT+MFIP, que puede provocar una escalada de privilegios. Se trata de una instancia de CWE-88, \"Neutralizaci\u00f3n incorrecta de delimitadores de argumentos en un comando (\u0027Inyecci\u00f3n de argumentos\u0027)\", y se estima como CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Este problema no se hab\u00eda solucionado en general al momento de la primera publicaci\u00f3n de este registro CVE."
}
],
"id": "CVE-2025-35004",
"lastModified": "2026-01-12T16:54:35.330",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
},
"published": "2025-06-08T21:15:31.807",
"references": [
{
"source": "cve@takeonme.org",
"tags": [
"Permissions Required"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"source": "cve@takeonme.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35004/"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"source": "cve@takeonme.org",
"tags": [
"Product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"sourceIdentifier": "cve@takeonme.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-88"
}
],
"source": "cve@takeonme.org",
"type": "Secondary"
}
]
}
CVE-2025-35010 (GCVE-0-2025-35010)
Vulnerability from cvelistv5 – Published: 2025-06-08 21:06 – Updated: 2025-06-09 03:16
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MNPINGTM Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35010",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:15:50.314272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:16:04.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:06:16.368Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35010/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MNPINGTM Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35010",
"datePublished": "2025-06-08T21:06:16.368Z",
"dateReserved": "2025-04-15T20:40:30.572Z",
"dateUpdated": "2025-06-09T03:16:04.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35009 (GCVE-0-2025-35009)
Vulnerability from cvelistv5 – Published: 2025-06-08 21:06 – Updated: 2025-06-09 03:17
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35009",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:16:59.379120Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:17:10.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:06:05.426Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35009/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35009",
"datePublished": "2025-06-08T21:06:05.426Z",
"dateReserved": "2025-04-15T20:40:30.572Z",
"dateUpdated": "2025-06-09T03:17:10.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35008 (GCVE-0-2025-35008)
Vulnerability from cvelistv5 – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:18
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35008",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:17:45.431505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:18:02.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:52.090Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35008/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35008",
"datePublished": "2025-06-08T21:05:52.090Z",
"dateReserved": "2025-04-15T20:40:30.572Z",
"dateUpdated": "2025-06-09T03:18:02.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35007 (GCVE-0-2025-35007)
Vulnerability from cvelistv5 – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:18
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MFRULE Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35007",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:18:45.423248Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:18:53.105Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:38.698Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35007/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MFRULE Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35007",
"datePublished": "2025-06-08T21:05:38.698Z",
"dateReserved": "2025-04-15T20:40:30.571Z",
"dateUpdated": "2025-06-09T03:18:53.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35006 (GCVE-0-2025-35006)
Vulnerability from cvelistv5 – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:19
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35006",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:19:38.062525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:19:46.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:25.706Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35006/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35006",
"datePublished": "2025-06-08T21:05:25.706Z",
"dateReserved": "2025-04-15T20:40:30.571Z",
"dateUpdated": "2025-06-09T03:19:46.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35005 (GCVE-0-2025-35005)
Vulnerability from cvelistv5 – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:20
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MFMAC Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35005",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:20:43.281393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:20:54.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:15.936Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35005/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MFMAC Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35005",
"datePublished": "2025-06-08T21:05:15.936Z",
"dateReserved": "2025-04-15T20:40:30.571Z",
"dateUpdated": "2025-06-09T03:20:54.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35004 (GCVE-0-2025-35004)
Vulnerability from cvelistv5 – Published: 2025-06-08 21:05 – Updated: 2025-06-09 03:22
VLAI?
Title
Microhard Bullet-LTE and IPn4Gii AT+MFIP Argument Injection
Summary
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Severity ?
7.1 (High)
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microhard | IPn4Gii / Bullet-LTE Firmware |
Affected:
0 , ≤ v1.2.0-r1132
(custom)
|
Credits
Ricky "HeadlessZeke" Lawshae of Keysight
todb
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35004",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T03:22:06.240054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T03:22:14.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IPn4Gii / Bullet-LTE Firmware",
"vendor": "Microhard",
"versions": [
{
"lessThanOrEqual": "v1.2.0-r1132",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb"
}
],
"datePublic": "2025-06-08T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88,\u0026nbsp;\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88,\u00a0\"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record\u0027s first publishing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-08T21:05:01.219Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/cves/cve-2025-35004/"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
},
{
"tags": [
"product"
],
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Microhard Bullet-LTE and IPn4Gii AT+MFIP Argument Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2025-35004",
"datePublished": "2025-06-08T21:05:01.219Z",
"dateReserved": "2025-04-15T20:40:30.571Z",
"dateUpdated": "2025-06-09T03:22:14.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}