CVE-2018-25144 — HIGH (8.4)

Vulnerability Description

Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read, modify, or delete arbitrary files. Attackers can exploit unsanitized 'path', 'savefile', 'edit', and 'delfile' parameters to perform unauthorized file system modifications through GET and POST requests.

CVSS Score

8.4

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Microhardcorp	Ipn4G Firmware	1.1.0
Microhardcorp	Ipn4G	-
Microhardcorp	Ipn3Gb Firmware	2.2.0
Microhardcorp	Ipn3Gb	-
Microhardcorp	Ipn4Gb Firmware	1.1.6
Microhardcorp	Ipn4Gb	-
Microhardcorp	Bullet-3G Firmware	1.2.0
Microhardcorp	Bullet-3G	-
Microhardcorp	Vip4Gb Firmware	1.1.6
Microhardcorp	Vip4Gb	-
Microhardcorp	Vip4Gb Wifi-N Firmware	1.1.6
Microhardcorp	Vip4Gb Wifi-N	-
Microhardcorp	Bullet-Lte Firmware	1.2.0
Microhardcorp	Bullet-Lte	-
Microhardcorp	Ipn3Gii Firmware	1.2.0
Microhardcorp	Ipn3Gii	-
Microhardcorp	Ipn4Gii Firmware	1.2.0
Microhardcorp	Ipn4Gii	-
Microhardcorp	Bulletplus Firmware	1.3.0
Microhardcorp	Bulletplus	-

Related Weaknesses (CWE)

CWE-22

References

http://www.microhardcorp.comProduct
https://www.exploit-db.com/exploits/45037Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.phpExploitThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.phpExploitThird Party Advisory

FAQ

What is CVE-2018-25144?

CVE-2018-25144 is a vulnerability with a CVSS score of 8.4 (HIGH). Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read, modify, or delete arbitrary files. Atta...

How severe is CVE-2018-25144?

CVE-2018-25144 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-25144?

Check the references section above for vendor advisories and patch information. Affected products include: Microhardcorp Ipn4G Firmware, Microhardcorp Ipn4G, Microhardcorp Ipn3Gb Firmware, Microhardcorp Ipn3Gb, Microhardcorp Ipn4Gb Firmware.