CVE-2025-35008
High
Description
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
SeverityHigh
CVSS7.1
Exploit probability—
ProductMicrohardcorp Ipn4gii-na2 Firmware
PublishedJun 8, 2025
First seenJun 8, 2025
Weakness typeCWE-88CWE-88
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microhardcorp ipn4gii-na2_firmware | v ≤ 1.2.0-r1132 | — |
| microhardcorp bulletlte-na2_firmware | v ≤ 1.2.0-r1132 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.