CVE-2018-25148

Microhard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface

High8.7EPSS 0.78%

Published: 24 Dec 2025
Updated: 24 Dec 2025
Reserved: 24 Dec 2025
Assigned by: VulnCheck

Description

Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create crontab jobs and modify system startup scripts. Attackers can exploit hidden admin features to execute arbitrary commands with root privileges, including starting services, disabling firewalls, and writing files to the system.

Scores

CVSS scores of CVE-2018-25148, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.78% · top 44% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-266: Incorrect Privilege Assignment (opens in a new tab)All about CWE-266 and its CVEs

Affected products

Microhard Systems · Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Remote Root Exploit
- affected IPn4G 1.1.0 build 1098

References (3)

ExploitDB-45038 (opens in a new tab)exploit
Microhard Systems Product Web Page (opens in a new tab)product
Zero Science Lab Disclosure (ZSL-2018-5479) (opens in a new tab)third-party-advisoryexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-25148](https://trackcve.app/badge/CVE-2018-25148.svg)](https://trackcve.app/cve/CVE-2018-25148)

Record last updated 24 Dec 2025, 20:25 UTC.