CVE-2018-25147

HIGH
Published Dec 24, 2025 Modified Jan 26, 2026 CWE-1392

Description

Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password combinations.

Is your site exposed to CVE-2018-25147?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-1392 CWE-1392

Affected Products

Vendor Product
microhardcorp ipn4g_firmware
microhardcorp ipn4g
microhardcorp ipn3gb_firmware
microhardcorp ipn3gb
microhardcorp ipn4gb_firmware
microhardcorp ipn4gb
microhardcorp ipn4gb_firmware
microhardcorp ipn4gb
microhardcorp ipn4gb_firmware
microhardcorp ipn4gb
microhardcorp bullet-3g_firmware
microhardcorp bullet-3g
microhardcorp vip4gb_firmware
microhardcorp vip4gb
microhardcorp vip4gb_firmware
microhardcorp vip4gb
microhardcorp vip4gb_wifi-n_firmware
microhardcorp vip4gb_wifi-n
microhardcorp bullet-3g_firmware
microhardcorp bullet-3g
microhardcorp bullet-lte_firmware
microhardcorp bullet-lte
microhardcorp ipn3gii_firmware
microhardcorp ipn3gii
microhardcorp ipn4gii_firmware
microhardcorp ipn4gii
microhardcorp bulletplus_firmware
microhardcorp bulletplus
microhardcorp dragon-lte_firmware
microhardcorp dragon-lte

References

Other References

http://www.microhardcorp.com

Frequently Asked Questions

What is CVE-2018-25147? +
Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password combinations. It has a CVSS v3.1 base score of 7.5 (HIGH).
How severe is CVE-2018-25147? +
CVE-2018-25147 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2018-25147? +
CVE-2018-25147 affects products from microhardcorp, specifically: bullet-3g, bullet-3g_firmware, bullet-lte, bullet-lte_firmware, bulletplus, bulletplus_firmware, dragon-lte, dragon-lte_firmware, ipn3gb, ipn3gb_firmware, ipn3gii, ipn3gii_firmware, ipn4g, ipn4g_firmware, ipn4gb, ipn4gb_firmware, ipn4gii, ipn4gii_firmware, vip4gb, vip4gb_firmware, vip4gb_wifi-n, vip4gb_wifi-n_firmware. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2018-25147? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-13893

Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might …
CVE-2024-5632

Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with …
CVE-2026-90456

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies …
CVE-2025-2184

A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical …
CVE-2026-9844

Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology (RabbitMQ Management interface modules) allows Default Usernames and Passwords. …
CVE-2026-90451

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2018-25147 — free, no signup required.