CVE-2018-25148

published 2025-12-24

CVE-2018-25148: Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create…

Priority P2 65 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create crontab jobs and modify system startup scripts. Attackers can exploit hidden admin features to execute arbitrary commands with root privileges, including starting services, disabling firewalls, and writing files to the system.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
microhard_systems	microhard_systems_3g_4g_cellular_ethernet_and_serial_gateway_remote_root_exploit	—	—
microhardcorp	bullet-3g_firmware	—	—
microhardcorp	bullet-lte_firmware	—	—
microhardcorp	bulletplus_firmware	—	—
microhardcorp	dragon-lte_firmware	—	—
microhardcorp	ipn3gb_firmware	—	—
microhardcorp	ipn3gii_firmware	—	—
microhardcorp	ipn4g_firmware	—	—
microhardcorp	ipn4gb_firmware	—	—
microhardcorp	ipn4gb_firmware	—	—
microhardcorp	ipn4gii_firmware	—	—
microhardcorp	vip4gb_firmware	—	—
microhardcorp	vip4gb_wifi-n_firmware	—	—

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-266