CVE-2018-4070

PoC —

CVSS 3.0

8.8 high

EPSS

18%p97

Published

May 6, 2019 (May 6, 2019)

Modified

Jun 17, 2026

Description

An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Get_Task.cgi endpoint.

Vendors: sierrawireless
Products: airlink es450 firmware
Weakness: CWE-200
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (18.0%)

In the news1 stories

Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless AirLink ES450

Cisco TalosApr 25, 18:06 UTC · Apr 25, 2019Vulnerability in the wildCVE-2018-4061 CVE-2018-4062 CVE-2018-4063+10 CVEs