Medium severity · published Dec 24, 2025
CVE-2018-25145
Microhard Systems IPn4G 1.1.0 Configuration Disclosure via Authenticated Download
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and network settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Configuration Download · Microhard Systems
IPn4G 1.1.0 build 1098 · source: vendor
BF
Bullet-3g Firmware · Microhardcorp
1.2.0; 1.2.0 · source: NVD
BF
Bullet-lte Firmware · Microhardcorp
1.2.0 · source: NVD
BF
Bulletplus Firmware · Microhardcorp
1.3.0 · source: NVD
DF
Dragon-lte Firmware · Microhardcorp
1.1.0 · source: NVD
IF
Ipn3gb Firmware · Microhardcorp
2.2.0 · source: NVD
IF
Ipn3gii Firmware · Microhardcorp
1.2.0 · source: NVD
IF
Ipn4g Firmware · Microhardcorp
1.1.0 · source: NVD
IF
Ipn4gb Firmware · Microhardcorp
1.1.6; 1.1.0; 1.1.0 · source: NVD
IF
Ipn4gii Firmware · Microhardcorp
1.2.0 · source: NVD
VF
Vip4gb Firmware · Microhardcorp
1.1.6; 1.1.6 · source: NVD
VW
Vip4gb Wifi-n Firmware · Microhardcorp
1.1.6 · source: NVD
Affected product
MS
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Configuration Download
Microhard Systems