← Back

CVE-2018-4063

nvd nist
Published: May 6, 2019Modified: Dec 15, 2025CISA KEV

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected (3)

Sierrawireless
1 product
Aleos
Configuration A
1 vulnerable · 4 platform
Vulnerable SoftwareAffected Versions
Aleos
Before 4.4.9
Running on/withPlatform Versions
Sierrawireless
Airlink Es440
All versions
Sierrawireless
Airlink Gx400
All versions
Sierrawireless
Airlink Gx440
All versions
Sierrawireless
Airlink Ls300
All versions
Configuration B
1 vulnerable · 6 platform
Vulnerable SoftwareAffected Versions
Aleos
Before 4.11.0
Running on/withPlatform Versions
Sierrawireless
Airlink Lx40
All versions
Sierrawireless
Airlink Lx60
All versions
Sierrawireless
Airlink Mp70
All versions
Sierrawireless
Airlink Mp70e
All versions
Sierrawireless
Airlink Rv50
All versions
Sierrawireless
Airlink Rv50x
All versions
Configuration C
1 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Aleos
Before 4.9.4
Running on/withPlatform Versions
Sierrawireless
Airlink Es450
All versions
Sierrawireless
Airlink Gx450
All versions

Related CWEs

CWE-434
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (10)

Source: talos-cna@cisco.com
ExploitVDB Entry
Source: talos-cna@cisco.com
Broken Link
Source: talos-cna@cisco.com
Third Party AdvisoryUS Government Resource
Source: talos-cna@cisco.com
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory

Timeline

No history available yet.