Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf - https://www.wired.com/s
ces: - https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf - https://www.wired.com/story/card-shuffler-hack/ - https://www.wired.com/story/how-hacked-card-shufflers-allegedly-enabled-a-mob-fueled-poker-scam-that-rocked-the-nba/ - https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-insecure-update-chain
CVE ID: CVE-2025-34501 State: PUBLISHED Published: 2025-11-03T21:56:54.734Z Last Updated: 2025-11-05T14:56:30.044Z Vendors: Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Products: Deck Mate 2 Problem Types: CWE-798 Description: Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once auth
ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf - https://www.vulncheck.com/advisories/shuffle-master-deck-mate
tent/uploads/2025/05/IOActive-card-shuffler-security.pdf - https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-hard-coded-credentials-and-exposed-services
CVE ID: CVE-2025-34502 State: PUBLISHED Published: 2025-10-24T23:04:11.948Z Last Updated: 2025-10-27T15:57:43.141Z Vendors: Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Products: Deck Mate 2 Problem Types: CWE-1326 Description: Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen up
term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf - https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-missing-secure-boot
CVE ID: CVE-2025-34503 State: PUBLISHED Published: 2025-10-24T23:04:43.922Z Last Updated: 2025-10-27T15:57:36.604Z Vendors: Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Products: Deck Mate 1 Problem Types: CWE-347, CWE-1326 Description: Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update mechanisms, affected systems should be physically protected or retired from service. The vendor has not indicated that firmware updates are avail
ems should be physically protected or retired from service. The vendor has not indicated that firmware updates are available for this legacy model. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf - https://www.vulncheck.com/advisories/shuffle-master-deck-mate-1-unauthenticated-eeprom-firmware-execution
CVE ID: CVE-2025-34508 State: PUBLISHED Published: 2025-06-17T14:14:48.419Z Last Updated: 2025-11-04T22:16:54.611Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ZendTo Products: ZendTo Problem Types: CWE-22 Description: A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host system, or cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://horizon3.ai/attack-research/attack-blogs/cve-2025-34508-another-file-sharing-application-another-path-
rences: - https://horizon3.ai/attack-research/attack-blogs/cve-2025-34508-another-file-sharing-application-another-path-traversal/ - https://www.vulncheck.com/advisories/zendto-path-traversal
CVE ID: CVE-2025-34509 State: PUBLISHED Published: 2025-06-17T18:20:57.441Z Last Updated: 2025-11-19T01:25:24.317Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Sitecore Products: Experience Manager, Experience Platform Problem Types: CWE-798 Description: Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtow
ess administrative API over HTTP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/ - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
CVE ID: CVE-2025-34510 State: PUBLISHED Published: 2025-06-17T18:46:04.239Z Last Updated: 2025-11-19T01:24:03.216Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sitecore Products: Experience Manager, Experience Platform, Experience Commerce Problem Types: CWE-23 Description: Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/ - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
CVE ID: CVE-2025-34511 State: PUBLISHED Published: 2025-06-17T19:05:10.466Z Last Updated: 2025-07-22T13:08:26.043Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sitecore Products: Powershell Extension Problem Types: CWE-434 Description: Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/is-b-for-backdoor-
xecution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/ - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
CVE ID: CVE-2025-34512 State: PUBLISHED Published: 2025-10-16T17:55:29.091Z Last Updated: 2025-10-16T19:20:50.779Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-79 Description: Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5961.php - https://www.vulncheck.com/advisor
://www.ilevia.com/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5961.php - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-reflected-xss
CVE ID: CVE-2025-34513 State: PUBLISHED Published: 2025-10-16T17:53:34.729Z Last Updated: 2025-11-03T19:11:24.630Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-78 Description: Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5962.php - https://www.vulncheck.com/advisori
//www.ilevia.com/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5962.php - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-unauth-command-injection
CVE ID: CVE-2025-34514 State: PUBLISHED Published: 2025-10-16T17:56:16.188Z Last Updated: 2025-10-16T18:48:44.076Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-78 Description: Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-
ISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-auth-command-injection
CVE ID: CVE-2025-34515 State: PUBLISHED Published: 2025-10-16T17:54:36.241Z Last Updated: 2025-11-06T18:52:00.689Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-250 Description: Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-root-priv-esc - https://www.zeroscience.mk/
/www.ilevia.com/ - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-root-priv-esc - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5965.php
CVE ID: CVE-2025-34516 State: PUBLISHED Published: 2025-10-16T17:52:55.159Z Last Updated: 2025-11-03T19:09:18.043Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-1392 Description: Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-use-of-default-credentials - https://www.zeroscience.mk/en/vulne
tps://www.vulncheck.com/advisories/ilevia-eve-x1-server-use-of-default-credentials - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5963.php
CVE ID: CVE-2025-34517 State: PUBLISHED Published: 2025-10-16T17:56:53.404Z Last Updated: 2025-10-16T18:39:54.280Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-22 Description: Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5960.php - https://www.vulncheck.com/advisories/ilevia-eve-x1-s
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5960.php - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-absolute-path-traversal
CVE ID: CVE-2025-34518 State: PUBLISHED Published: 2025-10-16T17:55:00.915Z Last Updated: 2025-10-16T19:22:32.017Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-22 Description: Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5960.php - https://www.vulncheck.com/advisories/ilevia-eve-x1-se
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5960.php - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-relative-path-traversal
CVE ID: CVE-2025-34519 State: PUBLISHED Published: 2025-10-16T17:55:50.634Z Last Updated: 2025-11-06T18:52:34.480Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-327 Description: Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an insecure hashing algorithm vulnerability. The product stores passwords using the MD5 hash function without applying a per‑password salt. Because MD5 is a fast, unsalted hash, an attacker who obtains the password database can efficiently perform offline dictionary, rainbow‑table, or brute‑force attacks to recover the original passwords. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 808
original passwords. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.vulncheck.com/advisories/ilevia-eve-x1-server-insecure-hashing-algorithm - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5964.php
CVE ID: CVE-2025-34520 State: PUBLISHED Published: 2025-08-27T21:19:43.364Z Last Updated: 2025-11-20T12:21:36.043Z Vendors: Arcserve Products: Unified Data Protection (UDP) Problem Types: CWE-288 Description: An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts. By manipulating specific request parameters or exploiting a logic flaw, an attacker can bypass login mechanisms without valid credentials and access administrator-level features. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Ve
vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-customers-on-all-versions
CVE ID: CVE-2025-34521 State: PUBLISHED Published: 2025-08-27T21:19:38.076Z Last Updated: 2025-11-20T12:21:26.168Z Vendors: Arcserve Products: Unified Data Protection (UDP) Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the Arcserve Unified Data Protection (UDP), where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by another user, execute arbitrary JavaScript in the victim’s browser. Successful exploitation may lead to session hijacking, credential theft, or other client-side impacts. The vulnerability re
cessful exploitation may lead to session hijacking, credential theft, or other client-side impacts. The vulnerability requires user interaction and occurs within a shared browser context. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-customers-on-
ences: - https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-customers-on-all-versions
CVE ID: CVE-2025-34522 State: PUBLISHED Published: 2025-08-27T21:19:33.132Z Last Updated: 2025-11-20T12:21:17.706Z Vendors: Arcserve Products: Unified Data Protection (UDP) Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without authentication by sending specially crafted input to the target system. Improper bounds checking allows an attacker to overwrite heap memory, potentially leading to application crashes or remote code execution. Exploitation occurs in the context of the affected process and does not require user interaction. The vulnerability poses a h
itation occurs in the context of the affected process and does not require user interaction. The vulnerability poses a high risk due to its pre-authentication nature and potential for full compromise. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-
chment: References: - https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-customers-on-all-versions
CVE ID: CVE-2025-34523 State: PUBLISHED Published: 2025-08-27T21:19:26.658Z Last Updated: 2025-11-20T12:21:10.448Z Vendors: Arcserve Products: Unified Data Protection (UDP) Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted data, a remote attacker can corrupt heap memory, potentially causing a denial of service or enabling arbitrary code execution depending on the memory layout and exploitation tech
ly causing a denial of service or enabling arbitrary code execution depending on the memory layout and exploitation techniques used. This vulnerability is similar in nature to CVE-2025-34522 but affects a separate code path or component. No user interaction is required, and exploitation occurs in the context of the vulnerable process. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue. Additional Analyst Notes: -
r are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-customers-on-all-versions
CVE ID: CVE-2025-35003 State: PUBLISHED Published: 2025-05-26T10:03:06.808Z Last Updated: 2025-05-28T03:56:07.159Z Vendors: Apache Software Foundation Products: Apache NuttX RTOS Problem Types: CWE-119, CWE-121 Description: Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets. NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues. This issue affects A
k users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues. This issue affects Apache NuttX: from 7.25 before 12.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/nuttx/pull/16179 - https://lists.apache.org/thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj
CVE ID: CVE-2025-35004 State: PUBLISHED Published: 2025-06-08T21:05:01.219Z Last Updated: 2025-06-09T03:22:14.184Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microhard Products: IPn4Gii / Bullet-LTE Firmware Problem Types: CWE-88 Description: Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been gene
njection')," and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-35004/ - https://www.microhardcorp.com/BulletLTE-NA2.php - https://www.microhardcorp.com/IPn4Gii-NA2.php - https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware