PT-2019-10799 · Sierra Wireless · Sierra Wireless Airlink Es450

Publicado 2019-05-06 · Atualizado 2019-10-03 · CVE-2018-4072

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3

Description A Permission Assignment issue exists in the ACEManager EmbeddedAceSet Task.cgi functionality. The EmbeddedAceSet Task.cgi executable is used to change MSCII configuration values within the configuration manager. This binary lacks restricted configuration settings, allowing any authenticated user to send configuration changes using the "/cgi-bin/Embedded Ace Set Task.cgi" endpoint once the MSCIID is discovered.

Recommendations For Sierra Wireless AirLink ES450 FW version 4.9.3, consider restricting access to the "/cgi-bin/Embedded Ace Set Task.cgi" endpoint to prevent unauthorized configuration changes until a patch is available.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-4072

Produtos afetados

Sierra Wireless Airlink Es450

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0756 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-4072 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-4072 · Aviso do Fabricante