CVE-2018-25145

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and network settings.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Microhard Systems	Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Configuration Download	IPn4G 1.1.0 build 1098

References

http://www.microhardcorp.comProduct
https://www.exploit-db.com/exploits/45036Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.phpExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5484.phpExploit, Third Party Advisory

Timeline

Published: Dec 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-251468.1Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running syst CVE-2018-251477.5Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can CVE-2018-251488.8Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attack CVE-2018-251496.5Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions wi CVE-2018-251505.3Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user ac CVE-2018-251514.3Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrat CVE-2018-251525.3Ecessa Edge EV150 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts wi CVE-2018-251549.8GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption CVE-2018-251554.3Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without pr CVE-2018-251564.3Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without prop CVE-2018-251576.4Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through cr CVE-2018-251588.8Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through t