PT-2019-10798 · Sierra Wireless · Sierra Wireless Airlink Es450

Published 2019-05-06 · Updated 2019-05-08 · CVE-2018-4071

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3

Description An Information Disclosure issue exists in the ACEManager EmbeddedAceGet Task.cgi functionality. The EmbeddedAceTLGet Task.cgi executable is used to retrieve MSCII configuration values within the configuration manager. This binary lacks restricted configuration settings, allowing any authenticated user to send configuration changes using the "/cgi-bin/Embedded Ace TLGet Task.cgi" endpoint.

Recommendations For Sierra Wireless AirLink ES450 FW version 4.9.3, consider restricting access to the "/cgi-bin/Embedded Ace TLGet Task.cgi" endpoint to prevent unauthorized configuration changes until a fix is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-4071

Affected Products

Sierra Wireless Airlink Es450

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0755 · Exploit
• https://osv.dev/vulnerability/CVE-2018-4071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-4071 · Security Note