EUVD-2025-17398CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4Description
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.
Analysis
Post-authentication command injection vulnerability in the AT+MNPINGTM command affecting Microhard BulletLTE-NA2 and IPn4Gii-NA2 products. An authenticated local attacker can exploit this CWE-88 argument injection flaw to achieve privilege escalation, gaining high-confidentiality and high-integrity impact. The vulnerability remains generally unfixed at the time of CVE publication, indicating active exposure in deployed systems.
Technical Context
The vulnerability exists in the AT command interface (a legacy Hayes modem protocol extended by manufacturers for device control) within Microhard's LTE modules. The AT+MNPINGTM command fails to properly neutralize argument delimiters when processing user-supplied input (CWE-88: Improper Neutralization of Argument Delimiters in a Command). This allows an authenticated user to inject shell metacharacters or additional command arguments, breaking out of the intended command context. The affected products—Microhard BulletLTE-NA2 and IPn4Gii-NA2—are industrial-grade LTE modems commonly deployed in critical infrastructure, IoT gateways, and remote communications systems where AT command interfaces are exposed to local or authenticated network access.
Affected Products
Microhard Systems products incorporating vulnerable modules: (1) BulletLTE-NA2 — all versions unless patched; (2) IPn4Gii-NA2 — all versions unless patched. These are LTE modem modules often integrated into OEM products (routers, gateways, industrial controllers). Without explicit version ranges or CPE strings provided in the CVE data, assume all current/legacy firmware versions are affected until Microhard releases patches. Likely CPE pattern: cpe:2.3:h:microhard:bulletlte-na2:*:*:*:*:*:*:*:* and cpe:2.3:h:microhard:ipn4gii-na2:*:*:*:*:*:*:*:*. No vendor advisory link provided in source material.
Remediation
At the time of CVE publication, no patch is generally available. Recommended actions: (1) Contact Microhard directly for security updates and estimated patch timeline; (2) If available, apply firmware updates to BulletLTE-NA2 and IPn4Gii-NA2 modules immediately upon release; (3) Implement access controls to restrict AT command interface access to trusted administrators only (disable remote AT access if not required); (4) Monitor AT command logs for suspicious AT+MNPINGTM usage (unusual argument patterns, shell metacharacters); (5) Segment networks to limit lateral movement if a low-privileged user gains access; (6) Consider temporary disable of the affected AT+MNPINGTM command if alternative ping/diagnostics methods are available. Workaround: restrict AT interface exposure via firewall rules or physical/logical segmentation until patches are available.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today