Microhard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface

Published 10 mo ago 2025-12-24 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.2%

percentile 13%

Public exploits

none known

Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated users into loading a specially crafted page.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 10 mo ago 2025-12-24

Exploit prediction (EPSS)

0.22% probability of exploitation in the next 30 days, higher than 13% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	5.1	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N`
CNA	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
CNA	4.0	5.1	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
CNA	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`

Affected products

Microhard Systems Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway CSRF Vulnerabilities

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

exploit-db.com /exploits/45034 · exploit
microhardcorp.com · product
zeroscience.mk /en/vulnerabilities/ZSL-2018-5478.php · third-party-advisory, exploit

Sources

CVE List: CVE-2018-25149
NVD: CVE-2018-25149

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary