CVE-2018-25143

Published: Dec 24, 2025Modified: Jan 26, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Microhard Systems IPn4G 1.1.0 contains a service vulnerability that allows authenticated users to enable a restricted SSH shell with a default 'msshc' user. Attackers can exploit a custom 'ping' command in the NcFTP environment to escape the restricted shell and execute commands with root privileges.

Affected (15)

Products: Microhardcorp: Ipn4g Firmware, Ipn3gb Firmware, Ipn4gb Firmware, Bullet 3g Firmware, Vip4gb Firmware, Vip4gb Wifi N Firmware, Bullet Lte Firmware, Ipn3gii Firmware, Ipn4gii Firmware, Bulletplus Firmware, Dragon Lte Firmware

11 products

Vip4gb Wifi N Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4g Firmware	Version 1.1.0 build1098

Running on/with	Platform Versions
Microhardcorp Ipn4g	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn3gb Firmware	Version 2.2.0 build2160

Running on/with	Platform Versions
Microhardcorp Ipn3gb	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.6 build1184-14

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.0 rev2_build1090-2

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.0 rev2_build1086

Running on/with	Platform Versions
Microhardcorp Ipn4gb	All versions

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Bullet 3g Firmware	Version 1.2.0 reva_build1032

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Firmware	Version 1.1.6 build_1204

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Firmware	Version 1.1.6 rev3_build1184-14

Running on/with	Platform Versions
Microhardcorp Vip4gb	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Wifi N Firmware	Version 1.1.6 rev2_build1196

Running on/with	Platform Versions
Microhardcorp Vip4gb Wifi N	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bullet 3g Firmware	Version 1.2.0 build1076

Running on/with	Platform Versions
Microhardcorp Bullet 3g	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bullet Lte Firmware	Version 1.2.0 build1078

Running on/with	Platform Versions
Microhardcorp Bullet Lte	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn3gii Firmware	Version 1.2.0 build1076

Running on/with	Platform Versions
Microhardcorp Ipn3gii	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gii Firmware	Version 1.2.0 build1078

Running on/with	Platform Versions
Microhardcorp Ipn4gii	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bulletplus Firmware	Version 1.3.0 build1036

Running on/with	Platform Versions
Microhardcorp Bulletplus	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Dragon Lte Firmware	Version 1.1.0 build1036

Running on/with	Platform Versions
Microhardcorp Dragon Lte	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

http://www.microhardcorp.com

Source: disclosure@vulncheck.com

Product

https://www.exploit-db.com/exploits/45041

Source: disclosure@vulncheck.com

Exploit

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5486.php

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5486.php

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.