CVE-2018-25144

Published: Dec 24, 2025Modified: Feb 2, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read, modify, or delete arbitrary files. Attackers can exploit unsanitized 'path', 'savefile', 'edit', and 'delfile' parameters to perform unauthorized file system modifications through GET and POST requests.

Affected (15)

Products: Microhardcorp: Ipn4g Firmware, Ipn3gb Firmware, Ipn4gb Firmware, Bullet 3g Firmware, Vip4gb Firmware, Vip4gb Wifi N Firmware, Bullet Lte Firmware, Ipn3gii Firmware, Ipn4gii Firmware, Bulletplus Firmware, Dragon Lte Firmware

11 products

Vip4gb Wifi N Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4g Firmware	Version 1.1.0 build1098

Running on/with	Platform Versions
Microhardcorp Ipn4g	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn3gb Firmware	Version 2.2.0 build2160

Running on/with	Platform Versions
Microhardcorp Ipn3gb	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.6 build1184-14

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.0 rev2_build1090-2

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.0 rev2_build1086

Running on/with	Platform Versions
Microhardcorp Ipn4gb	All versions

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Bullet 3g Firmware	Version 1.2.0 reva_build1032

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Firmware	Version 1.1.6 build_1204

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Firmware	Version 1.1.6 rev3_build1184-14

Running on/with	Platform Versions
Microhardcorp Vip4gb	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Wifi N Firmware	Version 1.1.6 rev2_build1196

Running on/with	Platform Versions
Microhardcorp Vip4gb Wifi N	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bullet 3g Firmware	Version 1.2.0 build1076

Running on/with	Platform Versions
Microhardcorp Bullet 3g	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bullet Lte Firmware	Version 1.2.0 build1078

Running on/with	Platform Versions
Microhardcorp Bullet Lte	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn3gii Firmware	Version 1.2.0 build1076

Running on/with	Platform Versions
Microhardcorp Ipn3gii	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gii Firmware	Version 1.2.0 build1078

Running on/with	Platform Versions
Microhardcorp Ipn4gii	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bulletplus Firmware	Version 1.3.0 build1036

Running on/with	Platform Versions
Microhardcorp Bulletplus	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Dragon Lte Firmware	Version 1.1.0 build1036

Running on/with	Platform Versions
Microhardcorp Dragon Lte	All versions

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

http://www.microhardcorp.com

Source: disclosure@vulncheck.com

Product

https://www.exploit-db.com/exploits/45037

Source: disclosure@vulncheck.com

Exploit

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.php

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.php

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.