Information Disclosure Vulnerability in Sierra Wireless AirLink ES450
CVE-2018-4071

8.8HIGH

Key Information:

Vendor

Sierrawireless

Status
Sierra Wireless
Vendor
CVE Published:
6 May 2019

What is CVE-2018-4071?

The AirLink ES450 from Sierra Wireless contains a vulnerability within the EmbeddedAceGet_Task.cgi functionality that allows for information disclosure. This vulnerability arises because the executable does not enforce restricted configuration settings. As a result, authenticated users can exploit this weakness by sending unauthorized configuration changes through the /cgi-bin/Embedded_Ace_TLGet_Task.cgi endpoint once they have discovered the MSCIID, leading to potential security risks within the network.

Affected Version(s)

Sierra Wireless Sierra Wireless AirLink ES450 FW 4.9.3

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

EPSS Score

39% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.