CVE-2018-25147 Microhard Systems IPn4G 1.1.0 Default Credentials Authentication Bypass

Critical 9.3 Published 24 Dec 2025 Updated 28 Jul 2026

Attackers can gain unauthorized root access to Microhard Systems IPn4G gateways using hardcoded default credentials that cannot be changed.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-25147?

CVE-2018-25147 is a critical vulnerability in Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Default Credentials, published on 24 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password combinations.

Weakness: CWE-1392

Which versions are affected by CVE-2018-25147?

It affects 11 products.

Products include Microhardcorp Bullet-3g Firmware, Microhardcorp Bullet-Lte Firmware, Microhardcorp Bulletplus Firmware, Microhardcorp Dragon-Lte Firmware, Microhardcorp Ipn3gb Firmware, Microhardcorp Ipn3gii Firmware and 5 more.

How do I fix CVE-2018-25147?

No fix has been published for CVE-2018-25147 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-25147 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25147 exists.

Sources

Also known as GHSA-r64v-2m5c-fmx7.