Information disclosure in Sierrawireless Airlink_es450
CVE-2018-4069
An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authentication functionality is done in plaintext XML to the web server. An attacker ca…
Vulnerability class: Information Disclosure
EPSS: 0.040 (89.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Sierrawireless Airlink_es450
- Sierrawireless Airlink_es450_firmware — versions 4.9.3
- N/a Sierra Wireless — versions Sierra Wireless AirLink ES450 FW 4.9.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- talos-cna@cisco.com (x_refsource_MISC)
- talos-cna@cisco.com (x_refsource_MISC)
- talos-cna@cisco.com (vdb-entry, x_refsource_BID)
- talos-cna@cisco.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-4069?
- CVE-2018-4069 is a high-severity vulnerability in Sierrawireless Airlink_es450, classified under Information Disclosure. CVSS score: 7.5/10. Published 2019-05-06.
- How severe is CVE-2018-4069?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2018-4069 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.