PT-2016-3199 · Sierra Wireless · Aleos+1

Published 2016-09-06 · Updated 2017-04-14 · CVE-2016-5066

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink GX 440 versions with ALEOS firmware 4.3.2

Description The issue is related to the use of predefined credentials in the ALEOS firmware of the Sierra Wireless AirLink GX 440 wireless modem. An attacker can exploit this to gain access to the system with the rights of one of the users: admin, rauser, sconsole, or user by recovering the corresponding passwords. The passwords for these users are weak, specifically: admin with password 2222, and rauser, sconsole, and user with password 12345.

Recommendations For Sierra Wireless AirLink GX 440 devices with ALEOS firmware 4.3.2, consider changing the default passwords for the admin, rauser, sconsole, and user accounts to stronger, unique passwords to prevent unauthorized access. As a temporary workaround, restrict access to the device until the passwords can be changed.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

BDU:2017-02463

CVE-2016-5066

Affected Products

Aleos

Sierra Wireless Airlink Es440

References · 4

• 🔥 https://carvesystems.com/sierra-wireless-2016-advisory.html · Exploit
• https://bdu.fstec.ru/vul/2017-02463 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5066 · Security Note