Sierrawireless Airlink_es450
26 CVEs affecting Sierrawireless Airlink_es450. Latest disclosed: 2020-10-06. Critical: 1, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11857 | Critical | 9.1 | 2020-08-21 | Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information. |
CVE-2018-4073 | High | 8.8 | 2019-05-06 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th… |
CVE-2018-4072 | High | 8.8 | 2019-05-06 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th… |
CVE-2018-4071 | High | 8.8 | 2019-05-06 | An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. T… |
CVE-2018-4070 | High | 8.8 | 2019-05-06 | An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. T… |
CVE-2018-4066 | High | 8.8 | 2019-05-06 | An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted H… |
CVE-2018-4063 | High | 8.8 | 2019-05-06 | An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP r… |
CVE-2018-4061 | High | 8.8 | 2019-05-06 | An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially craf… |
CVE-2019-11862 | High | 8.1 | 2020-08-21 | The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying. |
CVE-2019-11855 | High | 8.1 | 2020-08-21 | An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9. |
CVE-2018-4062 | High | 8.1 | 2019-05-06 | A hard-coded credentials vulnerability exists in the snmpd function of the Sierra Wireless AirLink ES450 FW 4.9.3. Activating snmpd outside of the WebUI can ca… |
CVE-2020-8781 | High | 7.8 | 2020-10-06 | Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process. |
CVE-2020-8782 | High | 7.5 | 2020-10-06 | Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution. |
CVE-2018-4069 | High | 7.5 | 2019-05-06 | An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authent… |
CVE-2019-11847 | High | 7.3 | 2020-08-21 | An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shel… |
CVE-2018-4064 | High | 7.1 | 2019-10-31 | An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speciall… |
CVE-2018-4067 | Medium | 6.5 | 2019-05-06 | An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speci… |
CVE-2018-4065 | Medium | 6.1 | 2019-05-06 | An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially… |
CVE-2019-11859 | Medium | 6.0 | 2020-08-21 | A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root. |
CVE-2019-11858 | Medium | 5.7 | 2020-08-21 | Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9. |