CVE-2018-25149 — MEDIUM (6.5)

Vulnerability Description

Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated users into loading a specially crafted page.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Microhardcorp	Ipn4G Firmware	1.1.0
Microhardcorp	Ipn4G	-
Microhardcorp	Ipn3Gb Firmware	2.2.0
Microhardcorp	Ipn3Gb	-
Microhardcorp	Ipn4Gb Firmware	1.1.6
Microhardcorp	Ipn4Gb	-
Microhardcorp	Bullet-3G Firmware	1.2.0
Microhardcorp	Bullet-3G	-
Microhardcorp	Vip4Gb Firmware	1.1.6
Microhardcorp	Vip4Gb	-
Microhardcorp	Vip4Gb Wifi-N Firmware	1.1.6
Microhardcorp	Vip4Gb Wifi-N	-
Microhardcorp	Bullet-Lte Firmware	1.2.0
Microhardcorp	Bullet-Lte	-
Microhardcorp	Ipn3Gii Firmware	1.2.0
Microhardcorp	Ipn3Gii	-
Microhardcorp	Ipn4Gii Firmware	1.2.0
Microhardcorp	Ipn4Gii	-
Microhardcorp	Bulletplus Firmware	1.3.0
Microhardcorp	Bulletplus	-

Related Weaknesses (CWE)

CWE-352

References

http://www.microhardcorp.comProduct
https://www.exploit-db.com/exploits/45034Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5478.phpExploitThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5478.phpExploitThird Party Advisory

FAQ

What is CVE-2018-25149?

CVE-2018-25149 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages ...

How severe is CVE-2018-25149?

CVE-2018-25149 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-25149?

Check the references section above for vendor advisories and patch information. Affected products include: Microhardcorp Ipn4G Firmware, Microhardcorp Ipn4G, Microhardcorp Ipn3Gb Firmware, Microhardcorp Ipn3Gb, Microhardcorp Ipn4Gb Firmware.