CVE-2019-11847

Published: Aug 21, 2020Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shell.

Affected (3)

Products: Sierrawireless: Aleos

Sierrawireless

1 product

Aleos

Configuration A

1 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Sierrawireless Aleos	Before 4.11.0

Running on/with	Platform Versions
Sierrawireless Airlink Lx40	All versions
Sierrawireless Airlink Lx60	All versions
Sierrawireless Airlink Mp70	All versions
Sierrawireless Airlink Mp70e	All versions
Sierrawireless Airlink Rv50	All versions
Sierrawireless Airlink Rv50x	All versions

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Sierrawireless Aleos	Before 4.9.4

Running on/with	Platform Versions
Sierrawireless Airlink Es450	All versions
Sierrawireless Airlink Gx450	All versions

Configuration C

1 vulnerable · 4 platform

Vulnerable Software	Affected Versions
Sierrawireless Aleos	Before 4.4.9

Running on/with	Platform Versions
Sierrawireless Airlink Es440	All versions
Sierrawireless Airlink Gx400	All versions
Sierrawireless Airlink Gx440	All versions
Sierrawireless Airlink Ls300	All versions

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/

Source: cve@mitre.org

Vendor Advisory

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.