CVE-2018-25149

Published: Dec 24, 2025Modified: Jan 26, 2026

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated users into loading a specially crafted page.

Affected (15)

Products: Microhardcorp: Ipn4g Firmware, Ipn3gb Firmware, Ipn4gb Firmware, Bullet 3g Firmware, Vip4gb Firmware, Vip4gb Wifi N Firmware, Bullet Lte Firmware, Ipn3gii Firmware, Ipn4gii Firmware, Bulletplus Firmware, Dragon Lte Firmware

11 products

Vip4gb Wifi N Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4g Firmware	Version 1.1.0 build1098

Running on/with	Platform Versions
Microhardcorp Ipn4g	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn3gb Firmware	Version 2.2.0 build2160

Running on/with	Platform Versions
Microhardcorp Ipn3gb	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.6 build1184-14

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.0 rev2_build1090-2

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gb Firmware	Version 1.1.0 rev2_build1086

Running on/with	Platform Versions
Microhardcorp Ipn4gb	All versions

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Bullet 3g Firmware	Version 1.2.0 reva_build1032

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Firmware	Version 1.1.6 build_1204

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Firmware	Version 1.1.6 rev3_build1184-14

Running on/with	Platform Versions
Microhardcorp Vip4gb	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Vip4gb Wifi N Firmware	Version 1.1.6 rev2_build1196

Running on/with	Platform Versions
Microhardcorp Vip4gb Wifi N	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bullet 3g Firmware	Version 1.2.0 build1076

Running on/with	Platform Versions
Microhardcorp Bullet 3g	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bullet Lte Firmware	Version 1.2.0 build1078

Running on/with	Platform Versions
Microhardcorp Bullet Lte	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn3gii Firmware	Version 1.2.0 build1076

Running on/with	Platform Versions
Microhardcorp Ipn3gii	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Ipn4gii Firmware	Version 1.2.0 build1078

Running on/with	Platform Versions
Microhardcorp Ipn4gii	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Bulletplus Firmware	Version 1.3.0 build1036

Running on/with	Platform Versions
Microhardcorp Bulletplus	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microhardcorp Dragon Lte Firmware	Version 1.1.0 build1036

Running on/with	Platform Versions
Microhardcorp Dragon Lte	All versions

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

http://www.microhardcorp.com

Source: disclosure@vulncheck.com

Product

https://www.exploit-db.com/exploits/45034

Source: disclosure@vulncheck.com

Exploit

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5478.php

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5478.php

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.