CVE-2025-35010 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.

Reserved 2025-04-15 | Published 2025-06-08 | Updated 2025-06-09 | Assigner AHA

HIGH: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Product status

Default status

unaffected

Any version

affected

Credits

Ricky "HeadlessZeke" Lawshae of Keysight finder

todb coordinator

References

takeonme.org/cves/cve-2025-35010/ third-party-advisory

www.microhardcorp.com/BulletLTE-NA2.php product

www.microhardcorp.com/IPn4Gii-NA2.php product

support.microhardcorp.com/...les/ipn4gii-bullet-lte-firmware product

cve.org (CVE-2025-35010)

nvd.nist.gov (CVE-2025-35010)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-35010

Support options

Helpdesk Chat, Email, Knowledgebase