Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless AirLink ES450
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-4072 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3 | 8.8 group max | 26% | PoC | |
| CVE-2018-4063 | Unrestricted File Upload Leading to Code Execution in Sierra Wireless AirLink ALEOS | 8.8 | 27% | KEVPoC ×3 | KEV |
| CVE-2018-4064 | An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3 | 7.1 | 14% | PoC |
From the original article
5 min read at blog.talosintelligence.com
Several exploitable vulnerabilities exist in the Sierra Wireless AirLink ES450, an LTE gateway designed for distributed enterprise, such as retail point-of-sale or industrial control systems. These flaws present a number of attack vectors for a malicious actor, and could allow them to remotely execute code on the victim machine, change the administrator’s password and expose user credentials, among other scenarios.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.