CVE-2018-4063

Warnung

Exploit

EPSS 0.8%
Veröffentlicht 06.05.2019 19:29:00
Zuletzt bearbeitet 15.12.2025 15:18:49
Quelle talos-cna@cisco.com
CVE-Watchlists
Login
Unerledigt
Login

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 1 Referenzen 9

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Sierrawireless ≫ Aleos Version < 4.4.9

   Sierrawireless ≫ Airlink Es440 Version-
   Sierrawireless ≫ Airlink Gx400 Version-
   Sierrawireless ≫ Airlink Gx440 Version-
   Sierrawireless ≫ Airlink Ls300 Version-

Sierrawireless ≫ Aleos Version < 4.11.0

   Sierrawireless ≫ Airlink Lx40 Version-
   Sierrawireless ≫ Airlink Lx60 Version-
   Sierrawireless ≫ Airlink Mp70 Version-
   Sierrawireless ≫ Airlink Mp70e Version-
   Sierrawireless ≫ Airlink Rv50 Version-
   Sierrawireless ≫ Airlink Rv50x Version-

Sierrawireless ≫ Aleos Version < 4.9.4

Sierrawireless ≫ Airlink Es450 Version-
Sierrawireless ≫ Airlink Gx450 Version-

12.12.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

Schwachstelle

Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.8%	0.736

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H