CVE-2018-4063

Опубликовано: 06 мая 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Низкий

Описание

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Ссылки

http://packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html
Exploit
VDB Entry
http://www.securityfocus.com/bid/108147
Broken Link
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03
Third Party Advisory
US Government Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0748
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html
Exploit
VDB Entry
http://www.securityfocus.com/bid/108147
Broken Link
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03
Third Party Advisory
US Government Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0748
Exploit
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4063
US Government Resource
https://www.forescout.com/blog/ot-network-security-threats-industrial-routers-under-attack/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

Версия до 4.4.9 (исключая)

Одно из

cpe:2.3:h:sierrawireless:airlink_es440:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_gx400:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_gx440:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_ls300:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

Версия до 4.11.0 (исключая)

Одно из

cpe:2.3:h:sierrawireless:airlink_lx40:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_lx60:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_mp70:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_mp70e:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_rv50:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_rv50x:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

Версия до 4.9.4 (исключая)

Одно из

cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:*

cpe:2.3:h:sierrawireless:airlink_gx450:-:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.00802

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-96pr-35f4-cf4c

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 74%

0.00802

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-434