PT-2019-10789 · Sierra Wireless · Sierra Wireless Airlink Es450

Published 2019-05-06 · Updated 2019-05-08 · CVE-2018-4062

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3

Description A hard-coded credentials issue exists in the snmpd function. Activating snmpd outside of the WebUI can cause the activation of the hard-coded credentials, resulting in the exposure of a privileged user. An attacker can activate snmpd without any configuration changes to trigger this issue.

Recommendations For Sierra Wireless AirLink ES450 FW version 4.9.3, consider disabling the snmpd function until a fix is available to prevent the exposure of hard-coded credentials.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-4062

Affected Products

Sierra Wireless Airlink Es450

References · 6

• 🔥 http://packetstormsecurity.com/files/152647/Sierra-Wireless-AirLink-ES450-SNMPD-Hard-Coded-Credentials.html · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0747 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-4062 · Security Note
• https://osv.dev/vulnerability/CVE-2018-4062 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03 · Note
• http://securityfocus.com/bid/108147 · Note