CVE-2019-11849

Published: Aug 21, 2020Modified: Nov 21, 2024

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution.

Affected (1)

Products: Sierrawireless: Aleos

1 product

Configuration A

1 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Sierrawireless Aleos	Before 4.11.0

Running on/with	Platform Versions
Sierrawireless Airlink Lx40	All versions
Sierrawireless Airlink Lx60	All versions
Sierrawireless Airlink Mp70	All versions
Sierrawireless Airlink Mp70e	All versions
Sierrawireless Airlink Rv50	All versions
Sierrawireless Airlink Rv50x	All versions

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/

Source: cve@mitre.org

Vendor Advisory

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.