CVE-2025-35009 Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection

High 7.1 Published 8 Jun 2025 Updated 9 Jun 2025

Attackers with local access can inject commands via the AT+MNNETSP argument to escalate privileges in Microhard LTE devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-35009?

CVE-2025-35009 is a high-severity command injection vulnerability in Microhard IPn4Gii / Bullet-LTE Firmware, published on 8 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.

Weakness: CWE-88

Which versions are affected by CVE-2025-35009?

It affects 2 products.

Products include Microhardcorp Bulletlte-Na2 Firmware, Microhardcorp Ipn4gii-Na2 Firmware.

How do I fix CVE-2025-35009?

No fix has been published for CVE-2025-35009 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-35009 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-35009 exists.

Sources

Also known as GHSA-wc8m-52qp-mpc9.