CVE-2018-25143
Privilege Escalation via SSH Shell Escape in Microhard IPn4G
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microhard_systems | ipn4g | 1.1.0 |
| microhard | vip4gb | * |
| microhard | bullet-3g | * |
| microhard | ipn4g | * |
| ncftp | ncftp | 3.2.5 |
| microhard | dragon-lte | * |
| microhard | ipn3gb | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA. However, given that the vulnerability allows authenticated users to gain root access to the device by escaping a restricted shell, it could potentially lead to unauthorized access to sensitive data or disruption of device operations, which may negatively affect compliance with data protection and security requirements in standards like GDPR and HIPAA. [2, 3]
Can you explain this vulnerability to me?
This vulnerability exists in Microhard Systems IPn4G devices where an authenticated user can enable a hidden SSH service called 'msshc' with default credentials. Logging in via SSH places the user in a restricted NcFTP shell environment. However, a custom 'ping' command in this shell is vulnerable to command injection, allowing the attacker to escape the restricted shell and execute arbitrary commands with root privileges on the device. [2, 3]
How can this vulnerability impact me? :
Exploiting this vulnerability allows an attacker with authenticated or CSRF-enabled access to the device's web administration panel to enable a hidden SSH service, log in with default credentials, and escape the restricted shell to gain full root access. This means the attacker can execute arbitrary commands with root privileges, potentially compromising the entire device, disrupting operations, stealing data, or using the device as a foothold for further attacks. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the 'msshc' service is enabled on the device and if the 'msshc' user account exists with default credentials. You can verify if SSH port 22 is open and accepting connections for the 'msshc' user. Additionally, inspecting the web administration panel for the enabled 'Microhard Sh' (msshc) service or checking for HTTP requests to endpoints like '/cgi-bin/webif/system-services.sh?service=msshc&action=start' or '/cgi-bin/webif/system-services.sh?service=msshc&action=enable' can indicate if the service is active. Commands to check on the device (if accessible) include: 1) `cat /etc/passwd | grep msshc` to see if the user exists, 2) `ps aux | grep msshc` to check if the service is running, 3) `netstat -tuln | grep :22` to verify if SSH port 22 is listening, and 4) attempting to SSH into the device using username 'msshc' and password 'msshc'. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or not enabling the hidden 'msshc' service via the device's web administration panel. If the service is already enabled, disable it by sending HTTP requests to '/cgi-bin/webif/system-services.sh?service=msshc&action=stop' and '/cgi-bin/webif/system-services.sh?service=msshc&action=disable' if supported. Change or remove the default 'msshc' user account credentials to prevent unauthorized SSH access. Restrict access to the web administration panel to trusted users only and protect against CSRF attacks. Additionally, monitor and block SSH access attempts using the 'msshc' user and consider network-level controls to limit access to port 22 on these devices. Applying any available firmware updates or patches from Microhard Systems when released is also recommended. [2, 3]