PT-2025-53368 · Microhardcorp · Bullet-3G Firmware+10

Published 2025-12-24 · Updated 2025-12-24 · CVE-2018-25148

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microhard Systems IPn4G version 1.1.0

Description Authenticated remote code execution flaws exist in the admin interface. Attackers can leverage hidden admin features to execute arbitrary commands with root privileges, enabling the creation of crontab jobs, modification of system startup scripts, starting of services, disabling of firewalls, and writing files to the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2018-25148

Affected Products

Bullet-3G Firmware

Bullet-Lte Firmware

Bulletplus Firmware

Dragon-Lte Firmware

Ipn3Gb Firmware

Ipn3Gii Firmware

Ipn4G Firmware

Ipn4Gb Firmware

Ipn4Gii Firmware

Vip4Gb Firmware

Vip4Gb Wifi-N Firmware

References · 5

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5479.php · Exploit
• 🔥 https://exploit-db.com/exploits/45038 · Exploit
• https://osv.dev/vulnerability/CVE-2018-25148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25148 · Security Note
• http://microhardcorp.com · Note