Type Vulnerability
A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. Known-exploited catalogue reports exploitation in the wild.
Sierra Wireless
Sierra Wireless AirLink ALEOS Unrestricted File Upload Vulnerability
CVE-2018-4063
What this means
This is rated high severity (8.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Sierrawireless Aleos, Sierrawireless Airlink es440 and Sierrawireless Airlink gx400, and 10 more are in your estate, and treat that as the priority.
Full vendor description
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Scoring and exploitation
8.8/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~27.3% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Sierra Wireless AirLink ALEOS
Weaknesses
CWE-434
Affected products ()
- Sierrawireless Aleos
- Sierrawireless Airlink es440
- Sierrawireless Airlink gx400
- Sierrawireless Airlink gx440
- Sierrawireless Airlink ls300
- Sierrawireless Airlink lx40
- Sierrawireless Airlink lx60
- Sierrawireless Airlink mp70
- Sierrawireless Airlink mp70e
- Sierrawireless Airlink rv50
- Sierrawireless Airlink rv50x
- Sierrawireless Airlink es450
- Sierrawireless Airlink gx450
Show the raw CPE strings (13)
- cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_es440:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_gx400:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_gx440:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_ls300:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_lx40:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_lx60:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_mp70:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_mp70e:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_rv50:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_rv50x:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:*
- cpe:2.3:h:sierrawireless:airlink_gx450:-:*:*:*:*:*:*:*
References
10 links from the CVE record, grouped by site.
packetstormsecurity.com1 link
securityfocus.com1 link
- 108147 (opens in a new tab)Broken Link
ics-cert.us-cert.gov1 link
- ICSA-19-122-03 (opens in a new tab)Third Party Advisory · US Government Resource
talosintelligence.com1 link
- TALOS-2018-0748 (opens in a new tab)Exploit · Third Party Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource
forescout.com1 link
- ot-network-security-threats-industrial-routers-under-attack (opens in a new tab)Exploit · Third Party Advisory