PT-2020-20386 · Sierra Wireless · Sierra Wireless Windows Mobile Broadband Driver Package

Published 2020-04-15 · Updated 2021-07-21 · CVE-2020-8948

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sierra Wireless Windows Mobile Broadband Driver Packages (MBDP) versions prior to build 5043

Description The issue allows an unprivileged user to overwrite arbitrary files in arbitrary folders using hard links. This could be leveraged to execute arbitrary code with system privileges.

Recommendations For versions prior to build 5043, update to build 5043 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and folders to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2020-8948

Affected Products

Sierra Wireless Windows Mobile Broadband Driver Package

References · 5

• https://osv.dev/vulnerability/CVE-2020-8948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8948 · Security Note
• https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2020-002-cve-2020-8948/#sthash.ByZB8ifG.dpbs · Vendor Advisory
• https://t.me/cvenotify/2799 · Telegram Post
• https://danishcyberdefence.dk/blog/sierra_wireless · Note