CVE-2018-25149

Microhard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface

Published Dec 24, 2025 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated users into loading a specially crafted page.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Type Values Removed Values Added
First Time appeared Microhardcorp bullet-3g
Microhardcorp bullet-3g Firmware
Microhardcorp bullet-lte
Microhardcorp bullet-lte Firmware
Microhardcorp bulletplus
Microhardcorp bulletplus Firmware
Microhardcorp dragon-lte
Microhardcorp dragon-lte Firmware
Microhardcorp ipn3gb
Microhardcorp ipn3gb Firmware
Microhardcorp ipn3gii
Microhardcorp ipn3gii Firmware
Microhardcorp ipn4g Firmware
Microhardcorp ipn4gb
Microhardcorp ipn4gb Firmware
Microhardcorp ipn4gii
Microhardcorp ipn4gii Firmware
Microhardcorp vip4gb
Microhardcorp vip4gb Firmware
Microhardcorp vip4gb Wifi-n
Microhardcorp vip4gb Wifi-n Firmware
CPEs cpe:2.3:h:microhardcorp:bullet-3g:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:bullet-lte:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:bulletplus:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:dragon-lte:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:ipn3gb:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:ipn3gii:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:ipn4g:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:ipn4gb:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:ipn4gii:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:vip4gb:-:*:*:*:*:*:*:*
cpe:2.3:h:microhardcorp:vip4gb_wifi-n:-:*:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:bullet-3g_firmware:1.2.0:build1076:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:bullet-3g_firmware:1.2.0:reva_build1032:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:bullet-lte_firmware:1.2.0:build1078:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:bulletplus_firmware:1.3.0:build1036:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:dragon-lte_firmware:1.1.0:build1036:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:ipn3gb_firmware:2.2.0:build2160:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:ipn3gii_firmware:1.2.0:build1076:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:ipn4g_firmware:1.1.0:build1098:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1086:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1090-2:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.6:build1184-14:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:ipn4gii_firmware:1.2.0:build1078:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:vip4gb_firmware:1.1.6:build_1204:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:vip4gb_firmware:1.1.6:rev3_build1184-14:*:*:*:*:*:*
cpe:2.3:o:microhardcorp:vip4gb_wifi-n_firmware:1.1.6:rev2_build1196:*:*:*:*:*:*
Vendors & Products Microhardcorp bullet-3g
Microhardcorp bullet-3g Firmware
Microhardcorp bullet-lte
Microhardcorp bullet-lte Firmware
Microhardcorp bulletplus
Microhardcorp bulletplus Firmware
Microhardcorp dragon-lte
Microhardcorp dragon-lte Firmware
Microhardcorp ipn3gb
Microhardcorp ipn3gb Firmware
Microhardcorp ipn3gii
Microhardcorp ipn3gii Firmware
Microhardcorp ipn4g Firmware
Microhardcorp ipn4gb
Microhardcorp ipn4gb Firmware
Microhardcorp ipn4gii
Microhardcorp ipn4gii Firmware
Microhardcorp vip4gb
Microhardcorp vip4gb Firmware
Microhardcorp vip4gb Wifi-n
Microhardcorp vip4gb Wifi-n Firmware
Type Values Removed Values Added
First Time appeared Microhardcorp
Microhardcorp ipn4g
Vendors & Products Microhardcorp
Microhardcorp ipn4g
Type Values Removed Values Added
Description Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated users into loading a specially crafted page.
Title Microhard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}