PT-2025-53367 · Microhardcorp · Bullet-3G Firmware+10

Published 2025-12-24 · Updated 2025-12-24 · CVE-2018-25147

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Microhard Systems IPn4G version 1.1.0

Description The device contains hardcoded default credentials that cannot be modified through standard gateway operations. This allows attackers to obtain unauthorized root-level access by using predefined username and password combinations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2018-25147

Affected Products

Bullet-3G Firmware

Bullet-Lte Firmware

Bulletplus Firmware

Dragon-Lte Firmware

Ipn3Gb Firmware

Ipn3Gii Firmware

Ipn4G Firmware

Ipn4Gb Firmware

Ipn4Gii Firmware

Vip4Gb Firmware

Vip4Gb Wifi-N Firmware

References · 5

• 🔥 https://exploit-db.com/exploits/45040 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5480.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-25147 · Security Note
• https://osv.dev/vulnerability/CVE-2018-25147 · Vendor Advisory
• http://microhardcorp.com · Note