Sierrawireless: >> Airlink Gx440 Security Vulnerabilities
A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root.
CVSS Score
6.0
EPSS Score
0.0
Published
2020-08-21
CVE-2018-4063
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Known exploited
CVSS Score
8.8
EPSS Score
0.009
Published
2019-05-06
Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (1) SSH or (2) TELNET session.
CVSS Score
10.0
EPSS Score
0.0
Published
2015-08-08
Page 2