PT-2019-10800 · Sierra Wireless · Sierra Wireless Airlink Es450

Publicado 2019-05-06 · Atualizado 2019-10-03 · CVE-2018-4073

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3

Description A Permission Assignment issue exists in the ACEManager EmbeddedAceSet Task.cgi functionality. The endpoint "/cgi-bin/Embeded Ace TLSet Task.cgi" allows for arbitrary setting writes, resulting in unverified changes to any system setting. An attacker can trigger this issue by making an authenticated HTTP request or running the binary as any user.

Recommendations For Sierra Wireless AirLink ES450 FW version 4.9.3, consider restricting access to the "/cgi-bin/Embeded Ace TLSet Task.cgi" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the EmbeddedAceSet Task.cgi functionality until a patch is available.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-4073

Produtos afetados

Sierra Wireless Airlink Es450

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0756 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-4073 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-4073 · Aviso do Fabricante