CVE-2025-35004

Executive Summary

CVE-2025-35004 is a post-authentication command injection vulnerability affecting the Microhard BulletLTE-NA2 and IPn4Gii-NA2 products. The flaw resides in the AT+MFIP command, where argument delimiters are not properly neutralized, allowing an authenticated attacker to inject arbitrary commands. This can lead to privilege escalation, enabling the attacker to gain elevated access and potentially compromise the device. The vulnerability is classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command) and has a CVSS score of 7.1 (High). At the time of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Local (L) – The attacker must have local access to the device.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs valid credentials.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full disclosure of sensitive data.
• Integrity (I): High (H) – Full compromise of data integrity.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. Although the attack vector is local, the low complexity and low privileges required make it a significant risk for environments where attackers have already gained initial access.

Deep Dive & Mechanics

The vulnerability is an instance of CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). The AT+MFIP command is used to configure or query the device's IP settings. The command parser fails to properly sanitize argument delimiters (e.g., spaces, semicolons, or newlines), allowing an authenticated user to inject additional commands or arguments.

Mechanism:

1. An attacker authenticates to the device (e.g., via SSH, serial console, or web interface).
2. The attacker sends a crafted AT+MFIP command containing injected delimiters.
3. The command parser interprets the injected delimiters as command separators, executing arbitrary commands.
4. The injected commands run with the privileges of the AT command handler, which may be root or a high-privilege user, leading to privilege escalation.

Example (conceptual):

AT+MFIP=192.168.1.1; /bin/sh -c 'id'

If the parser does not neutralize the semicolon, it may execute id after setting the IP.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void handle_mfip(char *input) {
    char ip[16];
    sscanf(input, "AT+MFIP=%s", ip);
    // No sanitization of ip
    system(ip); // or similar command execution
}

Patched Code (Conceptual):

void handle_mfip(char *input) {
    char ip[16];
    if (sscanf(input, "AT+MFIP=%15s", ip) != 1) {
        // Error handling
        return;
    }
    // Validate IP format
    if (!is_valid_ip(ip)) {
        // Error handling
        return;
    }
    // Use safe API instead of system()
    set_ip_address(ip);
}

Key Differences:

• Input validation: The patched code validates the IP format and rejects invalid characters.
• Safe API: Instead of using system() or similar, the patched code uses a dedicated function that does not interpret shell metacharacters.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for the device (e.g., admin/admin).
• Network or local access to the device's command interface (e.g., SSH, serial console).

Exploitation Steps:

1. Connect to the device via SSH or serial console.
2. Authenticate with valid credentials.
3. Send a crafted AT+MFIP command with injected commands:

   AT+MFIP=192.168.1.1; /bin/sh -c 'id > /tmp/pwned'
   

4. Verify execution by checking the output file or observing behavior.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor logs for unusual AT+MFIP commands containing shell metacharacters (;, |, &, `, $, etc.).
• Alert on commands that attempt to write to sensitive files or execute shell commands.
• Use network monitoring to detect anomalous traffic patterns from the device.

Hunting:

• Search for commands containing ;, |, &&, ||, or backticks in AT command logs.
• Look for processes spawned by the AT command handler that are not typical (e.g., /bin/sh, /bin/bash).

Indicators of Compromise (IOCs)

• File Artifacts:
  • /tmp/pwned or similar files created by injected commands.
  • Unusual entries in /var/log/messages or syslog containing shell metacharacters.
• Network Indicators:
  • Outbound connections from the device to unexpected IPs (e.g., attacker C2).
  • DNS queries to suspicious domains.
• Process Indicators:
  • Unexpected processes like /bin/sh, /bin/bash, or /usr/bin/python spawned by the AT command handler.
• Command Logs:
  • AT+MFIP commands containing ;, |, &, or other shell metacharacters.

Detection Engineering

YARA Rule

rule CVE_2025_35004_AT_MFIP_Command_Injection {
    meta:
        description = "Detects attempts to exploit CVE-2025-35004 via AT+MFIP command injection"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-35004"
    strings:
        $cmd1 = "AT+MFIP="
        $delim1 = ";"
        $delim2 = "|"
        $delim3 = "&"
        $delim4 = "`"
        $delim5 = "$("
    condition:
        $cmd1 and any of ($delim*)
}

Sigma Rule

title: CVE-2025-35004 AT+MFIP Command Injection Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects AT+MFIP commands containing shell metacharacters indicative of command injection
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-35004
logsource:
    product: microhard
    service: at_command_log
detection:
    selection:
        Command: "AT+MFIP=*"
    keywords:
        - ";"
        - "|"
        - "&"
        - "`"
        - "$("
    condition: selection and keywords
falsepositives:
    - Legitimate use of IP addresses containing dots (not metacharacters)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-35004 AT+MFIP Command Injection Attempt"; flow:to_server,established; content:"AT+MFIP="; pcre:"/AT\+MFIP=[^;|&`$]+[;|&`$]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit network access to the device's management interfaces (SSH, serial, web) to trusted IPs only.
2. Change Default Credentials: Ensure strong, unique passwords are used for all accounts.
3. Monitor Logs: Enable detailed logging of AT commands and monitor for suspicious patterns.
4. Disable Unused Services: If the AT command interface is not required, disable it.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Microhard that properly sanitizes the AT+MFIP command input.
• Workaround: If patching is not possible, consider implementing a network-based IPS/IDS rule to block AT+MFIP commands containing shell metacharacters.

Compensating Controls:

• Use a host-based firewall to restrict outbound connections from the device.
• Implement application whitelisting to prevent execution of unauthorized binaries.

Valters IT