CVE-2018-25146

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes and system services through a hidden feature, potentially causing service disruption and requiring device restart.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Microhard Systems	Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Service Control DoS	IPn4G 1.1.0 build 1098

References

http://www.microhardcorp.comProduct
https://www.exploit-db.com/exploits/45035Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5481.phpExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5481.phpExploit, Third Party Advisory

Timeline

Published: Dec 24, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-251477.5Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can CVE-2018-251488.8Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attack CVE-2018-251496.5Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions wi CVE-2018-251505.3Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user ac CVE-2018-251514.3Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrat CVE-2018-251525.3Ecessa Edge EV150 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts wi CVE-2018-251549.8GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption CVE-2018-251554.3Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without pr CVE-2018-251564.3Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without prop CVE-2018-251576.4Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through cr CVE-2018-251588.8Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through t CVE-2018-251599.8Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenti