What is CVE-2018-10251?

CVE-2018-10251 is a critical-severity vulnerability in Sierrawireless Aleos, classified under Missing Authorization. CVSS score: 9.8/10. Published 2018-05-04.

How severe is CVE-2018-10251?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Sierrawireless Aleos

CVE-2018-10251

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges.

Vulnerability class: Broken Access Control

EPSS: 0.045 (90.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

cve@mitre.org (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2018-10251?: CVE-2018-10251 is a critical-severity vulnerability in Sierrawireless Aleos, classified under Missing Authorization. CVSS score: 9.8/10. Published 2018-05-04.
How severe is CVE-2018-10251?: Critical severity. CVSS v3 base score is 9.8 out of 10.