Microhard IPn4G Cellular Gateways Cross-Site Request Forgery (CVE-2018-25149)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505057);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/05");

  script_cve_id("CVE-2018-25149");

  script_name(english:"Microhard IPn4G Cellular Gateways Cross-Site Request Forgery (CVE-2018-25149)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery
vulnerability that allows attackers to perform administrative actions
without user consent. Attackers can craft malicious web pages to
change admin passwords, add new users, and modify system settings by
tricking authenticated users into loading a specially crafted page.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.microhardcorp.com");
  script_set_attribute(attribute:"see_also", value:"https://www.exploit-db.com/exploits/45034");
  script_set_attribute(attribute:"see_also", value:"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5478.php");
  script_set_attribute(attribute:"see_also", value:"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5478.php");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-25149");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(352);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:bullet-lte_firmware:1.2.0:build1078");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:bulletplus_firmware:1.3.0:build1036");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:dragon-lte_firmware:1.1.0:build1036");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn3gb_firmware:2.2.0:build2160");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn3gii_firmware:1.2.0:build1076");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4g_firmware:1.1.0:build1098");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1086");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1090-2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4gb_firmware:1.1.6:build1184-14");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:ipn4gii_firmware:1.2.0:build1078");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:vip4gb_firmware:1.1.6:build_1204");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:vip4gb_firmware:1.1.6:rev3_build1184-14");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microhardcorp:vip4gb_wifi-n_firmware:1.1.6:rev2_build1196");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Microhard");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Microhard');

var asset = tenable_ot::assets::get(vendor:'Microhard');

var vuln_cpes = {
    "cpe:/o:microhardcorp:ipn4g_firmware:1.1.0:build1098" :
        {"versionEndIncluding" : "1.1.0", "versionStartIncluding" : "1.1.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn3gb_firmware:2.2.0:build2160" :
        {"versionEndIncluding" : "2.2.0", "versionStartIncluding" : "2.2.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn4gb_firmware:1.1.6:build1184-14" :
        {"versionEndIncluding" : "1.1.6", "versionStartIncluding" : "1.1.6", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1090-2" :
        {"versionEndIncluding" : "1.1.0", "versionStartIncluding" : "1.1.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn4gb_firmware:1.1.0:rev2_build1086" :
        {"versionEndIncluding" : "1.1.0", "versionStartIncluding" : "1.1.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:vip4gb_firmware:1.1.6:build_1204" :
        {"versionEndIncluding" : "1.1.6", "versionStartIncluding" : "1.1.6", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:vip4gb_firmware:1.1.6:rev3_build1184-14" :
        {"versionEndIncluding" : "1.1.6", "versionStartIncluding" : "1.1.6", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:vip4gb_wifi-n_firmware:1.1.6:rev2_build1196" :
        {"versionEndIncluding" : "1.1.6", "versionStartIncluding" : "1.1.6", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:bullet-lte_firmware:1.2.0:build1078" :
        {"versionEndIncluding" : "1.2.0", "versionStartIncluding" : "1.2.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn3gii_firmware:1.2.0:build1076" :
        {"versionEndIncluding" : "1.2.0", "versionStartIncluding" : "1.2.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:ipn4gii_firmware:1.2.0:build1078" :
        {"versionEndIncluding" : "1.2.0", "versionStartIncluding" : "1.2.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:bulletplus_firmware:1.3.0:build1036" :
        {"versionEndIncluding" : "1.3.0", "versionStartIncluding" : "1.3.0", "family" : "MicrohardCellularModem"},
    "cpe:/o:microhardcorp:dragon-lte_firmware:1.1.0:build1036" :
        {"versionEndIncluding" : "1.1.0", "versionStartIncluding" : "1.1.0", "family" : "MicrohardCellularModem"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);