high8.8
CVE-2018-25143
Microhard Systems IPn4G 1.1.0 contains a service vulnerability that allows authenticated users to enable a restricted SSH shell with a default 'msshc' user.
Impact
Microhard Systems IPn4G 1.1.0 contains a service vulnerability that allows authenticated users to enable a restricted SSH shell with a default 'msshc' user. Attackers can exploit a custom 'ping' command in the NcFTP environment to escape the restricted shell and execute commands with root privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microhardcorp | Ipn4g Firmware | Version 1.1.0 |
| Microhardcorp | Ipn3gb Firmware | Version 2.2.0 |
| Microhardcorp | Ipn4gb Firmware | Versions 1.1.6, 1.1.0 |
| Microhardcorp | Bullet-3g Firmware | Version 1.2.0 |
| Microhardcorp | Vip4gb Firmware | Version 1.1.6 |
| Microhardcorp | Vip4gb Wifi-N Firmware | Version 1.1.6 |
| Microhardcorp | Bullet-Lte Firmware | Version 1.2.0 |
| Microhardcorp | Ipn3gii Firmware | Version 1.2.0 |
| Microhardcorp | Ipn4gii Firmware | Version 1.2.0 |
| Microhardcorp | Bulletplus Firmware | Version 1.3.0 |
| Microhardcorp | Dragon-Lte Firmware | Version 1.1.0 |