PT-2014-2635 · Sierra Wireless · Airlink Raven X Ev-Do Gateway

Published 2014-01-15 · Updated 2014-01-16 · CVE-2013-2819

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink Raven X EV-DO gateway versions 4221 4.0.11.003 through 4221 4.0.11.003 Sierra Wireless AirLink Raven X EV-DO gateway versions 4228 4.0.11.003 through 4228 4.0.11.003

Description The issue allows remote attackers to install Trojan horse firmware by leveraging cleartext credentials in a crafted update or reprogramming action.

Recommendations For Sierra Wireless AirLink Raven X EV-DO gateway version 4221 4.0.11.003, update to a version that does not use cleartext credentials for updates or reprogramming actions. For Sierra Wireless AirLink Raven X EV-DO gateway version 4228 4.0.11.003, update to a version that does not use cleartext credentials for updates or reprogramming actions.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-2819

Affected Products

Airlink Raven X Ev-Do Gateway

References · 3

• http://sierrawireless.com/resources/support/airlink/docs/raven%20security%20vulnerability%202014-01-10.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2819 · Security Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-007-01A · Note