PT-2016-3198 · Sierra Wireless · Aleos+1

Published 2016-03-11 · Updated 2017-04-14 · CVE-2016-5071

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink GX 440 with ALEOS firmware version 4.3.2

Description The issue is related to insufficient access control in the ALEOS software of the Sierra Wireless AirLink GX 440 wireless gateway. Exploitation of this issue may allow a remote attacker to execute commands using the management web interface with root privileges.

Recommendations For Sierra Wireless AirLink GX 440 with ALEOS firmware version 4.3.2, consider restricting access to the management web interface until a patch is available. As a temporary workaround, limit the execution of commands with root privileges to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-02462

CVE-2016-5071

Affected Products

Aleos

Sierra Wireless Airlink Es440

References · 4

• 🔥 https://carvesystems.com/sierra-wireless-2016-advisory.html · Exploit
• https://bdu.fstec.ru/vul/2017-02462 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-5071 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5071 · Vendor Advisory