PT-2019-10797 · Sierra Wireless · Airlink Es450

Publicado 2019-05-06 · Atualizado 2019-05-07 · CVE-2018-4070

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3

Description An Information Disclosure issue exists in the ACEManager EmbeddedAceGet Task.cgi functionality. This allows any authenticated user to send configuration changes using the "/cgi-bin/Embedded Ace Get Task.cgi" endpoint once the MSCIID is discovered.

Recommendations For Sierra Wireless AirLink ES450 FW version 4.9.3, consider restricting access to the "/cgi-bin/Embedded Ace Get Task.cgi" endpoint until a fix is available. Additionally, review configuration settings to minimize potential impact. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-4070

Produtos afetados

Airlink Es450

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0755 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-4070 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-4070 · Aviso do Fabricante