Microhard IPn4G Cellular Gateways Incorrect Authorization (CVE-2018-25146)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505056);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/05");

  script_cve_id("CVE-2018-25146");

  script_name(english:"Microhard IPn4G Cellular Gateways Incorrect Authorization (CVE-2018-25146)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability
that allows authenticated attackers to list and manipulate running
system processes. Attackers can send arbitrary signals to kill
background processes and system services through a hidden feature,
potentially causing service disruption and requiring device restart.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.microhardcorp.com");
  script_set_attribute(attribute:"see_also", value:"https://www.exploit-db.com/exploits/45035");
  script_set_attribute(attribute:"see_also", value:"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5481.php");
  script_set_attribute(attribute:"see_also", value:"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5481.php");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-25146");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:bullet-lte_firmware:1.2.0:build1078");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:bulletplus_firmware:1.3.0:build1036");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:dragon-lte_firmware:1.1.0:build1036");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn3gb_firmware:2.2.0:build2160");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn3gii_firmware:1.2.0:build1076");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4g_firmware:1.1.0:build1098");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1086");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1090-2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4gb_firmware:1.1.6:build1184-14");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4gii_firmware:1.2.0:build1078");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:vip4gb_firmware:1.1.6:build_1204");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:vip4gb_firmware:1.1.6:rev3_build1184-14");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:vip4gb_wifi-n_firmware:1.1.6:rev2_build1196");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Microhard");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Microhard');

var asset = tenable_ot::assets::get(vendor:'Microhard');

var vuln_cpes = {
    "cpe:/o:microhardcorp:ipn4g_firmware:1.1.0:build1098" :
        {"versionEndIncluding" : "1.1.0", "versionStartIncluding" : "1.1.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn3gb_firmware:2.2.0:build2160" :
        {"versionEndIncluding" : "2.2.0", "versionStartIncluding" : "2.2.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn4gb_firmware:1.1.6:build1184-14" :
        {"versionEndIncluding" : "1.1.6", "versionStartIncluding" : "1.1.6", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1090-2" :
        {"versionEndIncluding" : "1.1.0", "versionStartIncluding" : "1.1.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1086" :
        {"versionEndIncluding" : "1.1.0", "versionStartIncluding" : "1.1.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:vip4gb_firmware:1.1.6:build_1204" :
        {"versionEndIncluding" : "1.1.6", "versionStartIncluding" : "1.1.6", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:vip4gb_firmware:1.1.6:rev3_build1184-14" :
        {"versionEndIncluding" : "1.1.6", "versionStartIncluding" : "1.1.6", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:vip4gb_wifi-n_firmware:1.1.6:rev2_build1196" :
        {"versionEndIncluding" : "1.1.6", "versionStartIncluding" : "1.1.6", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:bullet-lte_firmware:1.2.0:build1078" :
        {"versionEndIncluding" : "1.2.0", "versionStartIncluding" : "1.2.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn3gii_firmware:1.2.0:build1076" :
        {"versionEndIncluding" : "1.2.0", "versionStartIncluding" : "1.2.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn4gii_firmware:1.2.0:build1078" :
        {"versionEndIncluding" : "1.2.0", "versionStartIncluding" : "1.2.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:bulletplus_firmware:1.3.0:build1036" :
        {"versionEndIncluding" : "1.3.0", "versionStartIncluding" : "1.3.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:dragon-lte_firmware:1.1.0:build1036" :
        {"versionEndIncluding" : "1.1.0", "versionStartIncluding" : "1.1.0", "family" : "MicrohardCellularModem"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);