What is CVE-2019-11856?

CVE-2019-11856 is a low-severity vulnerability in Sierrawireless Airlink_es440, classified under Authentication Bypass by Capture-replay. CVSS score: 3.3/10. Published 2020-08-21.

How severe is CVE-2019-11856?

Low severity. CVSS v3 base score is 3.3 out of 10.

Vulnerability in Sierrawireless Airlink_es440

CVE-2019-11856

A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.

EPSS: 0.010 (58.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L.

Affected products

Sierrawireless Airlink_es440
Sierrawireless Airlink_es450
Sierrawireless Airlink_gx400
Sierrawireless Airlink_gx440
Sierrawireless Airlink_gx450
Sierrawireless Airlink_ls300
Sierrawireless Airlink_lx40
Sierrawireless Airlink_lx60
Sierrawireless Airlink_mp70
Sierrawireless Airlink_mp70e

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-11856?: CVE-2019-11856 is a low-severity vulnerability in Sierrawireless Airlink_es440, classified under Authentication Bypass by Capture-replay. CVSS score: 3.3/10. Published 2020-08-21.
How severe is CVE-2019-11856?: Low severity. CVSS v3 base score is 3.3 out of 10.