What’s Vulnerable › Vulnerabilities

CVE-2025-35005: Microhard Bullet-LTE and IPn4Gii AT+MFMAC Argument Injection

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-08 · updated 2026-06-17
• Weakness: CWE-88

Description

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.

Affected products

• Microhardcorp Bulletlte-Na2 Firmware: through 1.2.0-r1132
• Microhardcorp Ipn4Gii-Na2 Firmware: through 1.2.0-r1132

References

• https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware
• https://takeonme.org/cves/cve-2025-35005/
• https://www.microhardcorp.com/BulletLTE-NA2.php
• https://www.microhardcorp.com/IPn4Gii-NA2.php

Get alerted when CVE-2025-35005 or the next vulnerability affects your stack