CVE-2018-25144

HIGH

8.4

Beschreibung

Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read, modify, or delete arbitrary files. Attackers can exploit unsanitized 'path', 'savefile', 'edit', and 'delfile' parameters to perform unauthorized file system modifications through GET and POST requests.

CVE Details

CVSS v3.1 Bewertung8.4

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht12/24/2025

Zuletzt geandert2/2/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

microhardcorp:bullet-3gmicrohardcorp:bullet-3g_firmwaremicrohardcorp:bullet-ltemicrohardcorp:bullet-lte_firmwaremicrohardcorp:bulletplusmicrohardcorp:bulletplus_firmwaremicrohardcorp:dragon-ltemicrohardcorp:dragon-lte_firmwaremicrohardcorp:ipn3gbmicrohardcorp:ipn3gb_firmwaremicrohardcorp:ipn3giimicrohardcorp:ipn3gii_firmwaremicrohardcorp:ipn4gmicrohardcorp:ipn4g_firmwaremicrohardcorp:ipn4gbmicrohardcorp:ipn4gb_firmwaremicrohardcorp:ipn4giimicrohardcorp:ipn4gii_firmwaremicrohardcorp:vip4gbmicrohardcorp:vip4gb_firmwaremicrohardcorp:vip4gb_wifi-nmicrohardcorp:vip4gb_wifi-n_firmware

Schwachen (CWE)

CWE-22

Referenzen

http://www.microhardcorp.com(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/45037(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.php(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.php(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.