PT-2014-2636 · Sierra Wireless · Airlink Raven X Ev-Do Gateway

Published 2014-01-15 · Updated 2014-01-16 · CVE-2013-2820

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink Raven X EV-DO gateway versions 4221 4.0.11.003 and 4228 4.0.11.003

Description The issue allows remote attackers to reprogram the firmware via a replay attack using UDP ports 17336 and 17388.

Recommendations For versions 4221 4.0.11.003 and 4228 4.0.11.003, consider restricting access to UDP ports 17336 and 17388 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-2820

Affected Products

Airlink Raven X Ev-Do Gateway

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-2820 · Security Note
• http://sierrawireless.com/resources/support/airlink/docs/raven%20security%20vulnerability%202014-01-10.pdf · Vendor Advisory
• http://ics-cert.us-cert.gov/advisories/ICSA-14-007-01A · Note