PT-2016-3199 · Sierra Wireless · Aleos+1

Publicado 2016-09-06 · Atualizado 2017-04-14 · CVE-2016-5066

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink GX 440 versions with ALEOS firmware 4.3.2

Description The issue is related to the use of predefined credentials in the ALEOS firmware of the Sierra Wireless AirLink GX 440 wireless modem. An attacker can exploit this to gain access to the system with the rights of one of the users: admin, rauser, sconsole, or user by recovering the corresponding passwords. The passwords for these users are weak, specifically: admin with password 2222, and rauser, sconsole, and user with password 12345.

Recommendations For Sierra Wireless AirLink GX 440 devices with ALEOS firmware 4.3.2, consider changing the default passwords for the admin, rauser, sconsole, and user accounts to stronger, unique passwords to prevent unauthorized access. As a temporary workaround, restrict access to the device until the passwords can be changed.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

BDU:2017-02463

CVE-2016-5066

Produtos afetados

Aleos

Sierra Wireless Airlink Es440

Referências · 4

• 🔥 https://carvesystems.com/sierra-wireless-2016-advisory.html · Exploit
• https://bdu.fstec.ru/vul/2017-02463 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-5066 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-5066 · Nota de Segurança