CVE-2018-25145 — MEDIUM (6.5)

Vulnerability Description

Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and network settings.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Microhardcorp	Ipn4G Firmware	1.1.0
Microhardcorp	Ipn4G	-
Microhardcorp	Ipn3Gb Firmware	2.2.0
Microhardcorp	Ipn3Gb	-
Microhardcorp	Ipn4Gb Firmware	1.1.6
Microhardcorp	Ipn4Gb	-
Microhardcorp	Bullet-3G Firmware	1.2.0
Microhardcorp	Bullet-3G	-
Microhardcorp	Vip4Gb Firmware	1.1.6
Microhardcorp	Vip4Gb	-
Microhardcorp	Vip4Gb Wifi-N Firmware	1.1.6
Microhardcorp	Vip4Gb Wifi-N	-
Microhardcorp	Bullet-Lte Firmware	1.2.0
Microhardcorp	Bullet-Lte	-
Microhardcorp	Ipn3Gii Firmware	1.2.0
Microhardcorp	Ipn3Gii	-
Microhardcorp	Ipn4Gii Firmware	1.2.0
Microhardcorp	Ipn4Gii	-
Microhardcorp	Bulletplus Firmware	1.3.0
Microhardcorp	Bulletplus	-

Related Weaknesses (CWE)

CWE-552

References

http://www.microhardcorp.comProduct
https://www.exploit-db.com/exploits/45036Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.phpExploitThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.phpExploitThird Party Advisory

FAQ

What is CVE-2018-25145?

CVE-2018-25145 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve config...

How severe is CVE-2018-25145?

CVE-2018-25145 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-25145?

Check the references section above for vendor advisories and patch information. Affected products include: Microhardcorp Ipn4G Firmware, Microhardcorp Ipn4G, Microhardcorp Ipn3Gb Firmware, Microhardcorp Ipn3Gb, Microhardcorp Ipn4Gb Firmware.