PT-2019-10789 · Sierra Wireless · Sierra Wireless Airlink Es450

Publicado 2019-05-06 · Atualizado 2019-05-08 · CVE-2018-4062

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3

Description A hard-coded credentials issue exists in the snmpd function. Activating snmpd outside of the WebUI can cause the activation of the hard-coded credentials, resulting in the exposure of a privileged user. An attacker can activate snmpd without any configuration changes to trigger this issue.

Recommendations For Sierra Wireless AirLink ES450 FW version 4.9.3, consider disabling the snmpd function until a fix is available to prevent the exposure of hard-coded credentials.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-4062

Produtos afetados

Sierra Wireless Airlink Es450

Referências · 6

• 🔥 http://packetstormsecurity.com/files/152647/Sierra-Wireless-AirLink-ES450-SNMPD-Hard-Coded-Credentials.html · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0747 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-4062 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03 · Nota
• http://securityfocus.com/bid/108147 · Nota
• https://osv.dev/vulnerability/CVE-2018-4062 · Aviso do Fabricante