Unverified Password Change in Sierra Wireless AirLink ES450
CVE-2018-4064

7.1HIGH

Key Information:

Vendor

Sierrawireless

Status
Sierra Wireless
Vendor
CVE Published:
31 October 2019

What is CVE-2018-4064?

A vulnerability exists in the ACEManager upload.cgi functionality of the Sierra Wireless AirLink ES450, allowing an attacker to exploit an unverified password change. By sending a specially crafted HTTP request, an authenticated user can unintentionally change the device configuration, leading to unauthorized alterations of user passwords. This poses significant risks to device integrity and security, emphasizing the need for prompt updates and vigilance in device management.

Affected Version(s)

Sierra Wireless Sierra Wireless AirLink ES450 FW 4.9.3

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.