Information Disclosure in Sierra Wireless AirLink ES450 Firmware
CVE-2018-4070

8.8HIGH

Key Information:

Vendor

Sierrawireless

Status
Sierra Wireless
Vendor
CVE Published:
6 May 2019

What is CVE-2018-4070?

An exploitable vulnerability in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3 allows any authenticated user to send unauthorized configuration changes. The lack of restricted settings exposes sensitive information through the /cgi-bin/Embedded_Ace_Get_Task.cgi endpoint once the MSCIID is identified.

Affected Version(s)

Sierra Wireless Sierra Wireless AirLink ES450 FW 4.9.3

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

EPSS Score

39% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.