CVE-2018-4064

CVSS 3.1: 7.1 high
EPSS: 14%p97
Published: Oct 31, 2019 · Oct 31, 2019
Modified: Jun 17, 2026

Analyze CVE-2018-4064 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the device. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Vendors: sierrawireless

Products: airlink es450 firmware

Weakness: CWE-287

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

NVD CVE.org GitHub PoCs EPSS (14.5%)

In the news

1 story

Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless AirLink ES450

Cisco TalosApr 25, 18:06 UTC · Apr 25, 2019VulnerabilityExploitedCVE-2018-4061 CVE-2018-4062 CVE-2018-4063+103