CVE-2018-4072

PoC —

CVSS 3.0

8.8 high

EPSS

26%p98

Published

May 6, 2019 (May 6, 2019)

Modified

Jun 17, 2026

Description

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSet_Task.cgi executable is used to change MSCII configuration values within the configuration manager of the AirLink ES450. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Set_Task.cgi endpoint.

Vendors: sierrawireless
Products: airlink es450 firmware
Weakness: CWE-732
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (26.4%)

In the news1 stories

Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless AirLink ES450

Cisco TalosApr 25, 18:06 UTC · Apr 25, 2019Vulnerability in the wildCVE-2018-4061 CVE-2018-4062 CVE-2018-4063+10 CVEs