PT-2022-8092 · Sierra Wireless · Sierra Wireless Mgos

Published 2022-12-26 · Updated 2023-01-05 · CVE-2019-13988

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sierra Wireless MGOS versions prior to 3.15.2 Sierra Wireless MGOS versions 4.x prior to 4.3

Description The issue allows attackers to read log files via a Direct Request, also known as Forced Browsing. This can potentially expose sensitive information.

Recommendations For Sierra Wireless MGOS versions prior to 3.15.2, update to version 3.15.2 or later. For Sierra Wireless MGOS versions 4.x prior to 4.3, update to version 4.3 or later. As a temporary workaround, consider restricting access to log files until a patch is available.

Fix

Related Identifiers

CVE-2019-13988

Affected Products

Sierra Wireless Mgos

References · 6

• https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13988 · Vendor Advisory
• https://sierrawireless.com/company/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13988 · Security Note
• https://t.me/cvenotify/40736 · Telegram Post
• https://t.me/cibsecurity/55376 · Telegram Post