10

CVE-2018-10251

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sierrawireless ≫ Aleos Version < 4.4.7
   Sierrawireless ≫ Es440 Version -
   Sierrawireless ≫ Gx400 Version -
   Sierrawireless ≫ Gx440 Version -
   Sierrawireless ≫ Ls300 Version -
Sierrawireless ≫ Aleos Version < 4.9.3
   Sierrawireless ≫ Es450 Version -
   Sierrawireless ≫ Gx450 Version -
   Sierrawireless ≫ Mp70 Version -
   Sierrawireless ≫ Mp70e Version -
   Sierrawireless ≫ Rv50 Version -
   Sierrawireless ≫ Rv50x Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.49% 0.902
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/
Vendor Advisory
Mitigation