PT-2018-9785 · Sierra Wireless · Sierra Wireless Airlink Rv50+5

Published 2018-05-04 · Updated 2019-10-03 · CVE-2018-10251

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers versions prior to 4.4.7 Sierra Wireless AirLink GX450, ES450, RV50, RV50X, MP70, and MP70E routers versions prior to 4.9.3

Description: A vulnerability could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges.

Recommendations: For Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers, update the firmware to version 4.4.7 or later. For Sierra Wireless AirLink GX450, ES450, RV50, RV50X, MP70, and MP70E routers, update the firmware to version 4.9.3 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-1188

Related Identifiers

CVE-2018-10251

Affected Products

Sierra Wireless Airlink Es440

Sierra Wireless Airlink Es450

Sierra Wireless Airlink Gx400

Sierra Wireless Airlink Ls300

Sierra Wireless Airlink Mp70

Sierra Wireless Airlink Rv50

References · 3

• https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10251 · Security Note