CVE-2018-25148
Microhard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface
- State
- Published
- Severity
- 8.7 High
- Published
- Dec 24, 2025
- Updated
- Dec 24, 2025
- Reserved
- Dec 24, 2025
Description
Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create crontab jobs and modify system startup scripts. Attackers can exploit hidden admin features to execute arbitrary commands with root privileges, including starting services, disabling firewalls, and writing files to the system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-266 Incorrect Privilege Assignment
Affected Products
| Product | Versions |
|---|---|
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Remote Root ExploitMicrohard Systems |
|
References
- ExploitDB-45038exploit
- Microhard Systems Product Web Pageproduct
- Zero Science Lab Disclosure (ZSL-2018-5479)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.