CVE-2018-4061

PoC —

CVSS 3.0

8.8 high

EPSS

19%p97

Published

May 6, 2019 (May 6, 2019)

Modified

Jun 17, 2026

Description

An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can inject arbitrary commands, resulting in arbitrary command execution. An attacker can send an authenticated HTTP request to trigger this vulnerability.

Vendors: sierrawireless
Products: airlink es450 firmware
Weakness: CWE-78
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (19.5%)

In the news2 stories

Other Sierra AirLink router models affected by critical flaws

Security AffairsMay 6, 12:48 UTC · May 6, 2019Vulnerability CVE-2018-4061 CVE-2018-4063 CVE-2018-4066+4 CVEs

Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless AirLink ES450

Cisco TalosApr 25, 18:06 UTC · Apr 25, 2019Vulnerability in the wildCVE-2018-4061 CVE-2018-4062 CVE-2018-4063+10 CVEs