CVE-2018-4066

CVSS 3.0: 8.8 high
EPSS: 2%p79
Published: May 6, 2019 · May 6, 2019
Modified: Jun 17, 2026

Analyze CVE-2018-4066 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause an authenticated user to perform privileged requests unknowingly, resulting in unauthenticated requests being requested through an authenticated user. An attacker can get an authenticated user to request authenticated pages on the attacker's behalf to trigger this vulnerability.

Vendors: sierrawireless

Products: airlink es450 firmware

Weakness: CWE-352

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news

2 stories

Other Sierra AirLink router models affected by critical flaws

Security AffairsMay 6, 12:48 UTC · May 6, 2019VulnerabilityCVE-2018-4061 CVE-2018-4063 CVE-2018-4066+42 · 1 read

Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless AirLink ES450

Cisco TalosApr 25, 18:06 UTC · Apr 25, 2019VulnerabilityExploitedCVE-2018-4061 CVE-2018-4062 CVE-2018-4063+103