medium6.5
CVE-2018-25145
Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configura…
Impact
Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and network settings.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microhardcorp | Ipn4g Firmware | Version 1.1.0 |
| Microhardcorp | Ipn3gb Firmware | Version 2.2.0 |
| Microhardcorp | Ipn4gb Firmware | Versions 1.1.6, 1.1.0 |
| Microhardcorp | Bullet-3g Firmware | Version 1.2.0 |
| Microhardcorp | Vip4gb Firmware | Version 1.1.6 |
| Microhardcorp | Vip4gb Wifi-N Firmware | Version 1.1.6 |
| Microhardcorp | Bullet-Lte Firmware | Version 1.2.0 |
| Microhardcorp | Dragon-Lte Firmware | Version 1.1.0 |
| Microhardcorp | Bulletplus Firmware | Version 1.3.0 |
| Microhardcorp | Ipn4gii Firmware | Version 1.2.0 |
| Microhardcorp | Ipn3gii Firmware | Version 1.2.0 |