What’s Vulnerable › Vulnerabilities

CVE-2018-25145: Microhard Systems IPn4G 1.1.0 Configuration Disclosure via Authenticated Download

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-24 · updated 2026-06-17
• Weakness: CWE-552

Description

Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and network settings.

Affected products

• Microhardcorp Bullet-3G Firmware: 1.2.0-reva_build1032, 1.2.0-build1076
• Microhard Bullet-LTE: 1.2.0-build1078
• Microhardcorp Bulletplus Firmware: 1.3.0-build1036
• Microhardcorp Dragon-Lte Firmware: 1.1.0-build1036
• Microhardcorp Ipn3Gb Firmware: 2.2.0-build2160
• Microhardcorp Ipn3Gii Firmware: 1.2.0-build1076
• Microhardcorp Ipn4G Firmware: 1.1.0-build1098
• Microhardcorp Ipn4Gb Firmware: 1.1.6-build1184-14, 1.1.0-rev2_build1090-2, 1.1.0-rev2_build1086
• Microhardcorp Ipn4Gii Firmware: 1.2.0-build1078
• Microhardcorp Vip4Gb Firmware: 1.1.6-build_1204, 1.1.6-rev3_build1184-14
• Microhardcorp Vip4Gb Wifi-N Firmware: 1.1.6-rev2_build1196

References

• http://www.microhardcorp.com
• https://www.exploit-db.com/exploits/45036
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.php

Get alerted when CVE-2018-25145 or the next vulnerability affects your stack