# Code execution as root via AT commands on the Quectel EG25-G modem

Quectel EG25-G modem's atfwd_daemon passes unsanitized AT+QFUMOCFG dmacc parameter to system(), enabling root command injection via backticks.

- Payout: $2,000
- Severity: high
- Program: Quectel
- Credited: nns
- Disclosed: 2021-04-03
- CVE: CVE-2021-31698
- Write-up quality: 8/10
- Original: https://nns.ee/blog/2021/04/03/modem-rce.html
- Library page: https://bugbountylibrary.com/r/blog%3Anns-ee-blog-2021-04-03-modem-rce-html
- Tags: domain:iot impact:privesc impact:rce kind:bounty platform:blog sev:high tech:linux technique:reverse-engineering technique:source-review vuln:command-injection vuln:rce

**Target:** atfwd_daemon AT command parser over /dev/ttyHSL0 serial
**Root cause:** quectel_handle_fumo_cfg_command() sprintf's user-controlled param1[1] as %s into 'ipth_dme -dmacc %s &' and passes it to system() without sanitization.
**Steps:**
1. Extract atfwd_daemon from firmware update package or via adb.
2. Load in Ghidra; note 233 system() calls; find quectel_handle_fumo_cfg_command using %s formatting.
3. Trace callers: quectel_parse_fumo_cfg_cmd_params matches input starting with 'dmacc', rest passed through.
4. Identify AT command +QFUMOCFG as entry point.
5. Send `AT+QFUMOCFG="dmacc","`reboot`"` over serial to execute as root.
**How found:** Prior post suspected the AT command daemon used many system() calls; extracted atfwd_daemon from firmware, loaded in Ghidra, audited the 233 system() sites for %s-formatted user input lacking sanitization, found the dmacc path.
**Exploitation:** Attacker with serial access to the modem sends an AT+QFUMOCFG command whose dmacc parameter contains backtick-wrapped shell commands; the daemon's system() call executes them as root on the modem's Linux, output returned over serial.
**Insight:** When auditing firmware daemons, grep for system() sites where user input is sprintf'd as %s rather than converted to integers; trace the AT command parser upward to find the externally reachable command name.