CVE-2018-4069

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

4.06%

Published

May 6, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authentication functionality is done in plaintext XML to the web server. An attacker can listen to network traffic upstream from the device to capitalize on this vulnerability.

Weaknesses (CWE)

CWE-200

Affected Products (2)

sierrawireless · airlink_es450_firmwarevulnerable

sierrawireless · airlink_es450

References (8)

http://packetstormsecurity.com/files/152654/Sierra-Wireless-AirLink-ES450-ACEManager-Information-Exposure.html

http://www.securityfocus.com/bid/108147

https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0754

ExploitThird Party Advisory

http://packetstormsecurity.com/files/152654/Sierra-Wireless-AirLink-ES450-ACEManager-Information-Exposure.html