What’s Vulnerable › Vulnerabilities

CVE-2018-25148: Microhard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-24 · updated 2026-06-17
• Weakness: CWE-266

Description

Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create crontab jobs and modify system startup scripts. Attackers can exploit hidden admin features to execute arbitrary commands with root privileges, including starting services, disabling firewalls, and writing files to the system.

Affected products

• Microhardcorp Bullet-3G Firmware: 1.2.0-reva_build1032, 1.2.0-build1076
• Microhard Bullet-LTE: 1.2.0-build1078
• Microhardcorp Bulletplus Firmware: 1.3.0-build1036
• Microhardcorp Dragon-Lte Firmware: 1.1.0-build1036
• Microhardcorp Ipn3Gb Firmware: 2.2.0-build2160
• Microhardcorp Ipn3Gii Firmware: 1.2.0-build1076
• Microhardcorp Ipn4G Firmware: 1.1.0-build1098
• Microhardcorp Ipn4Gb Firmware: 1.1.6-build1184-14, 1.1.0-rev2_build1090-2, 1.1.0-rev2_build1086
• Microhardcorp Ipn4Gii Firmware: 1.2.0-build1078
• Microhardcorp Vip4Gb Firmware: 1.1.6-build_1204, 1.1.6-rev3_build1184-14
• Microhardcorp Vip4Gb Wifi-N Firmware: 1.1.6-rev2_build1196

References

• http://www.microhardcorp.com
• https://www.exploit-db.com/exploits/45038
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5479.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5479.php

Get alerted when CVE-2018-25148 or the next vulnerability affects your stack