CRLF Injection Vulnerability in Sierra Wireless AirCard Products

CVE-2015-2054

What is CVE-2015-2054?

A CRLF injection vulnerability exists in the export.cfg file of the web-based administrative console for several models of Sierra Wireless AirCard devices. This vulnerability allows remote attackers to inject arbitrary HTTP headers through the use of CRLF sequences in the 'save' parameter. By exploiting this weakness, an attacker could manipulate headers, potentially leading to further attacks such as session fixation, content spoofing, or other malicious activities that compromise the security and integrity of the affected devices.

References