CVE-2018-25145
Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and network settings.
- Score
- CVSS 4.0 7.1 High
- Status
- Analyzed - disclosure@vulncheck.com
- Published
- 2025-12-24
- Last modified
- 2026-07-28
- Weaknesses
- CWE-552
Affected products
- Configuration (Edx)
- Bullet-3g Firmware (Microhardcorp)
- Bullet-lte Firmware (Microhardcorp)
- Bulletplus Firmware (Microhardcorp)
- Dragon-lte Firmware (Microhardcorp)
- Ipn3gb Firmware (Microhardcorp)
- Ipn3gii Firmware (Microhardcorp)
- Ipn4g Firmware (Microhardcorp)
- Ipn4gb Firmware (Microhardcorp)
- Ipn4gii Firmware (Microhardcorp)
- Vip4gb Firmware (Microhardcorp)
- Vip4gb Wifi-n Firmware (Microhardcorp)
References
- http://www.microhardcorp.com
- https://www.exploit-db.com/exploits/45036
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.php
