CVE-2018-4061

CVSS 3.0: 8.8 high
EPSS: 19%p97
Published: May 6, 2019 · May 6, 2019
Modified: Jun 17, 2026

Analyze CVE-2018-4061 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can inject arbitrary commands, resulting in arbitrary command execution. An attacker can send an authenticated HTTP request to trigger this vulnerability.

Vendors: sierrawireless

Products: airlink es450 firmware

Weakness: CWE-78

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (19.5%)

In the news

2 stories

Other Sierra AirLink router models affected by critical flaws

Security AffairsMay 6, 12:48 UTC · May 6, 2019VulnerabilityCVE-2018-4061 CVE-2018-4063 CVE-2018-4066+42 · 1 read

Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless AirLink ES450

Cisco TalosApr 25, 18:06 UTC · Apr 25, 2019VulnerabilityExploitedCVE-2018-4061 CVE-2018-4062 CVE-2018-4063+103