CVE-2018-25144CWE-22

Microhard Systems IPn4G 1.1.0 Arbitrary File Access via Undocumented System Editor

High · published December 24, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

⚡ An unguarded script lets attackers read and alter files like a chef swapping recipes without permission! Think of it like a café where a waiter can sneak into the kitchen and change all the orders without the chef ever knowing — a serious breach of trust! With this vulnerability, an authenticated attacker could sneak in and read sensitive files, modify critical settings, or even delete important data. That's like giving someone the keys to your house and letting them rearrange everything — absolutely devastating!

Put simply

Think of it like a café where a waiter can sneak into the kitchen and change all the orders without the chef ever knowing — a serious breach of trust! This vulnerability in Microhard Systems IPn4G 1.1.0 allows authenticated users to exploit unsanitized parameters in the hidden system-editor.sh script, enabling unauthorized file system modifications through GET and POST requests.

What to do

With this vulnerability, an authenticated attacker could sneak in and read sensitive files, modify critical settings, or even delete important data. That's like giving someone the keys to your house and letting them rearrange everything — absolutely devastating! To fix this, immediately patch your system to version 1.1.1 or later. Additionally, ensure that all input parameters are properly sanitized to prevent unauthorized access. Regular audits of user permissions can also help bolster security. You've got this! Follow these steps, and you’ll have this vulnerability locked down in no time! 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-12-24T19:27Z
EPSS history
Timeline
  • 24 DEC 19:27Z
    Microhard Systems IPn4G 1.1.0 Arbitrary File Access via Undocumented System Editor
    cvelistv5