PT-2019-10793 · Sierra Wireless · Sierra Wireless Airlink Es450

Carl Hurd + 1 · Published 2019-05-06 · Updated 2019-05-07 · CVE-2018-4066

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3

Description A cross-site request forgery issue exists in the ACEManager functionality. This allows an attacker to trick an authenticated user into making unintended requests, potentially leading to unauthorized access. The attacker can exploit this to get an authenticated user to request pages on their behalf.

Recommendations For Sierra Wireless AirLink ES450 FW version 4.9.3, consider implementing additional validation for HTTP requests to prevent unauthorized access until a patch is available. As a temporary workaround, restrict access to the ACEManager functionality to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-4066

Affected Products

Sierra Wireless Airlink Es450

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0751 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-4066 · Security Note
• https://osv.dev/vulnerability/CVE-2018-4066 · Vendor Advisory
• http://packetstormsecurity.com/files/152651/Sierra-Wireless-AirLink-ES450-ACEManager-Cross-Site-Request-Forgery.html · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03 · Note
• http://securityfocus.com/bid/108147 · Note