PT-2025-53364 · Microhardcorp · Bullet-3G Firmware+10

Published 2025-12-24 · Updated 2026-02-02 · CVE-2018-25144

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microhard Systems IPn4G version 1.1.0

Description The software contains an authentication bypass that allows authorized attackers to read, modify, or delete arbitrary files. The issue resides in the hidden system-editor.sh script. Attackers can exploit unsanitized parameters to perform unauthorized file system modifications through GET and POST requests. The vulnerable parameters include path, savefile, edit, and delfile.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-25144

Affected Products

Bullet-3G Firmware

Bullet-Lte Firmware

Bulletplus Firmware

Dragon-Lte Firmware

Ipn3Gb Firmware

Ipn3Gii Firmware

Ipn4G Firmware

Ipn4Gb Firmware

Ipn4Gii Firmware

Vip4Gb Firmware

Vip4Gb Wifi-N Firmware

References · 6

• 🔥 https://exploit-db.com/exploits/45037 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-25144 · Security Note
• https://osv.dev/vulnerability/CVE-2018-25144 · Vendor Advisory
• https://t.me/cveNotify/150585 · Telegram Post
• http://microhardcorp.com · Note