What’s Vulnerable › Vulnerabilities

CVE-2018-25147: Microhard Systems IPn4G 1.1.0 Default Credentials Authentication Bypass

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-24 · updated 2026-06-17
• Weakness: CWE-1392

Description

Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password combinations.

Affected products

• Microhardcorp Bullet-3G Firmware: 1.2.0-reva_build1032, 1.2.0-build1076
• Microhard Bullet-LTE: 1.2.0-build1078
• Microhardcorp Bulletplus Firmware: 1.3.0-build1036
• Microhardcorp Dragon-Lte Firmware: 1.1.0-build1036
• Microhardcorp Ipn3Gb Firmware: 2.2.0-build2160
• Microhardcorp Ipn3Gii Firmware: 1.2.0-build1076
• Microhardcorp Ipn4G Firmware: 1.1.0-build1098
• Microhardcorp Ipn4Gb Firmware: 1.1.6-build1184-14, 1.1.0-rev2_build1090-2, 1.1.0-rev2_build1086
• Microhardcorp Ipn4Gii Firmware: 1.2.0-build1078
• Microhardcorp Vip4Gb Firmware: 1.1.6-build_1204, 1.1.6-rev3_build1184-14
• Microhardcorp Vip4Gb Wifi-N Firmware: 1.1.6-rev2_build1196

References

• http://www.microhardcorp.com
• https://www.exploit-db.com/exploits/45040
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5480.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5480.php

Get alerted when CVE-2018-25147 or the next vulnerability affects your stack