CVE-2018-25144: high-severity vulnerability in Microhard Systems 3G/4G Cellular Ethernet and…
Microhard Systems IPn4G 1.1.0 Arbitrary File Access via Undocumented System Editor
Published · Updated
Follow this CVE+ Monitor Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Arbitrary File Attacks
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read, modify, or delete arbitrary files. Attackers can exploit unsanitized 'path', 'savefile', 'edit', and 'delfile' parameters to perform unauthorized file system modifications through GET and POST requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N