Microhard Systems IPn4G 1.1.0 Default Credentials Authentication Bypass
Priority HIGH 81CWE-1392Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password combinations.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microhard | Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Default Credentials | IPn4G 1.1.0 build 1098 | — | No fix listed | CNA |
- Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Default Credentials VendorMicrohard Affected IPn4G 1.1.0 build 1098 Fixed in — No fix listed CNA
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microhardcorp:ipn4g_firmware:1.1.0:build1098:*:*:*:*:*:* | 1.1.0 build1098 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:ipn4g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:ipn3gb_firmware:2.2.0:build2160:*:*:*:*:*:* | 2.2.0 build2160 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:ipn3gb:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.6:build1184-14:*:*:*:*:*:* | 1.1.6 build1184-14 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:ipn4gb:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1090-2:*:*:*:*:*:* | 1.1.0 rev2_build1090-2 | Vulnerable | Microhard |
| cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1086:*:*:*:*:*:* | 1.1.0 rev2_build1086 | Vulnerable | Microhard |
| cpe:2.3:o:microhardcorp:bullet-3g_firmware:1.2.0:reva_build1032:*:*:*:*:*:* | 1.2.0 reva_build1032 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:bullet-3g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
- cpe:2.3:o:microhardcorp:ipn4g_firmware:1.1.0:build1098:*:*:*:*:*:* Versions 1.1.0 build1098 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:ipn4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:ipn3gb_firmware:2.2.0:build2160:*:*:*:*:*:* Versions 2.2.0 build2160 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:ipn3gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.6:build1184-14:*:*:*:*:*:* Versions 1.1.6 build1184-14 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:ipn4gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1090-2:*:*:*:*:*:* Versions 1.1.0 rev2_build1090-2 Vulnerable ·Microhard
- cpe:2.3:o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1086:*:*:*:*:*:* Versions 1.1.0 rev2_build1086 Vulnerable ·Microhard
- cpe:2.3:o:microhardcorp:bullet-3g_firmware:1.2.0:reva_build1032:*:*:*:*:*:* Versions 1.2.0 reva_build1032 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:bullet-3g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microhardcorp:vip4gb_firmware:1.1.6:build_1204:*:*:*:*:*:* | 1.1.6 build_1204 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:vip4gb:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:vip4gb_firmware:1.1.6:rev3_build1184-14:*:*:*:*:*:* | 1.1.6 rev3_build1184-14 | Vulnerable | Microhard |
| cpe:2.3:o:microhardcorp:vip4gb_wifi-n_firmware:1.1.6:rev2_build1196:*:*:*:*:*:* | 1.1.6 rev2_build1196 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:vip4gb_wifi-n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:bullet-3g_firmware:1.2.0:build1076:*:*:*:*:*:* | 1.2.0 build1076 | Vulnerable | Microhard |
| cpe:2.3:o:microhardcorp:bullet-lte_firmware:1.2.0:build1078:*:*:*:*:*:* | 1.2.0 build1078 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:bullet-lte:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:ipn3gii_firmware:1.2.0:build1076:*:*:*:*:*:* | 1.2.0 build1076 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:ipn3gii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:ipn4gii_firmware:1.2.0:build1078:*:*:*:*:*:* | 1.2.0 build1078 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:ipn4gii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:bulletplus_firmware:1.3.0:build1036:*:*:*:*:*:* | 1.3.0 build1036 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:bulletplus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
| cpe:2.3:o:microhardcorp:dragon-lte_firmware:1.1.0:build1036:*:*:*:*:*:* | 1.1.0 build1036 | Vulnerable | Microhard |
| cpe:2.3:h:microhardcorp:dragon-lte:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microhard |
- cpe:2.3:o:microhardcorp:vip4gb_firmware:1.1.6:build_1204:*:*:*:*:*:* Versions 1.1.6 build_1204 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:vip4gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:vip4gb_firmware:1.1.6:rev3_build1184-14:*:*:*:*:*:* Versions 1.1.6 rev3_build1184-14 Vulnerable ·Microhard
- cpe:2.3:o:microhardcorp:vip4gb_wifi-n_firmware:1.1.6:rev2_build1196:*:*:*:*:*:* Versions 1.1.6 rev2_build1196 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:vip4gb_wifi-n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:bullet-3g_firmware:1.2.0:build1076:*:*:*:*:*:* Versions 1.2.0 build1076 Vulnerable ·Microhard
- cpe:2.3:o:microhardcorp:bullet-lte_firmware:1.2.0:build1078:*:*:*:*:*:* Versions 1.2.0 build1078 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:bullet-lte:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:ipn3gii_firmware:1.2.0:build1076:*:*:*:*:*:* Versions 1.2.0 build1076 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:ipn3gii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:ipn4gii_firmware:1.2.0:build1078:*:*:*:*:*:* Versions 1.2.0 build1078 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:ipn4gii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:bulletplus_firmware:1.3.0:build1036:*:*:*:*:*:* Versions 1.3.0 build1036 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:bulletplus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
- cpe:2.3:o:microhardcorp:dragon-lte_firmware:1.1.0:build1036:*:*:*:*:*:* Versions 1.1.0 build1036 Vulnerable ·Microhard
- cpe:2.3:h:microhardcorp:dragon-lte:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microhard
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-25147
- 2026-10-03 Alias added: GHSA-r64v-2m5c-fmx7
References
More Microhard Bullet-3g Firmware vulnerabilities
- TI-2018-15369 Microhard Systems IPn4G 1.1.0 Backdoor Jailbreak via Microhard Sh Service CVSS 4.0HIGH 8.7
- TI-2018-15374 Microhard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface CVSS 4.0HIGH 8.7
- TI-2018-15370 Microhard Systems IPn4G 1.1.0 Arbitrary File Access via Undocumented System Editor CVSS 4.0HIGH 8.7
- TI-2018-15372 Microhard Systems IPn4G 1.1.0 Service Control Denial of Service CVSS 4.0HIGH 7.1
- TI-2018-15371 Microhard Systems IPn4G 1.1.0 Configuration Disclosure via Authenticated Download CVSS 4.0HIGH 7.1
- TI-2018-15375 Microhard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface CVSS 4.0MEDIUM 5.1
Sources
- CVE-2018-25147 · CVE Program
- CVE-2018-25147 · NVD
- FIRST EPSS
- GHSA-r64v-2m5c-fmx7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences