CVE-2025-35006 Microhard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument Injection

High 7.1 Published 8 Jun 2025 Updated 9 Jun 2025

Attackers with local access can inject commands via the AT+MFPORTFWD command to escalate privileges on Microhard LTE devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-35006?

CVE-2025-35006 is a high-severity command injection vulnerability in Microhard IPn4Gii / Bullet-LTE Firmware, published on 8 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.

Weakness: CWE-88

Which versions are affected by CVE-2025-35006?

It affects 2 products.

Products include Microhardcorp Bulletlte-Na2 Firmware, Microhardcorp Ipn4gii-Na2 Firmware.

How do I fix CVE-2025-35006?

No fix has been published for CVE-2025-35006 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-35006 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-35006 exists.

Sources

Also known as GHSA-pvmg-5w26-65m7.