{"id":"CVE-2025-35008","aliases":["EUVD-2025-17400","GHSA-8qf9-3v8p-qxx6"],"status":"published","title":"Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection","description":"Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01051,"percentile":0.64562,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-88"],"published":"2025-06-08T21:05:52Z","modified":"2026-06-17T09:14:13Z","products":[{"vendor":"microhard","product":"ipn4gii / bullet-lte firmware"},{"vendor":"microhardcorp","product":"bulletlte-na2_firmware"},{"vendor":"microhardcorp","product":"ipn4gii-na2_firmware"}],"references":[{"url":"https://takeonme.org/cves/cve-2025-35008/","tags":["third-party-advisory","Exploit","Third Party Advisory"]},{"url":"https://www.microhardcorp.com/BulletLTE-NA2.php","tags":["product","Product"]},{"url":"https://www.microhardcorp.com/IPn4Gii-NA2.php","tags":["product","Product"]},{"url":"https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware","tags":["product","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-35008"},{"url":"https://takeonme.org/cves/cve-2025-35008"},{"url":"https://github.com/advisories/GHSA-8qf9-3v8p-qxx6"}],"sources":{"cve":[{"id":"CVE-2025-35008","title":"Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument Injection","description":"Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.","status":"published","published":"2025-06-08T21:05:52.09Z","modified":"2025-06-09T03:18:02.029Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:32:51.199669Z"}],"euvd":[{"id":"EUVD-2025-17400","description":"Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.","status":"published","published":"2025-06-08T21:05:52Z","modified":"2025-06-09T03:18:02Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:28.158705Z"}],"ghsa":[{"id":"GHSA-8qf9-3v8p-qxx6","title":"Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post...","description":"Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.","status":"published","published":"2025-06-08T21:30:30Z","modified":"2025-06-08T21:30:37Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:02:37.263061Z"}],"nvd":[{"id":"CVE-2025-35008","description":"Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.","status":"published","published":"2025-06-08T21:15:32.363Z","modified":"2026-06-17T09:14:13.28Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:11:11.4244Z"}]}}