Sierrawireless Airlink_lx40
15 CVEs affecting Sierrawireless Airlink_lx40. Latest disclosed: 2020-10-06. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11857 | Critical | 9.1 | 2020-08-21 | Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information. |
CVE-2018-4063 | High | 8.8 | 2019-05-06 | An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP r… |
CVE-2019-11862 | High | 8.1 | 2020-08-21 | The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying. |
CVE-2019-11855 | High | 8.1 | 2020-08-21 | An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9. |
CVE-2020-8781 | High | 7.8 | 2020-10-06 | Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process. |
CVE-2020-8782 | High | 7.5 | 2020-10-06 | Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution. |
CVE-2019-11847 | High | 7.3 | 2020-08-21 | An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shel… |
CVE-2019-11850 | Medium | 6.3 | 2020-08-21 | A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution |
CVE-2019-11849 | Medium | 6.3 | 2020-08-21 | A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution. |
CVE-2019-11859 | Medium | 6.0 | 2020-08-21 | A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root. |
CVE-2019-11858 | Medium | 5.7 | 2020-08-21 | Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9. |
CVE-2019-11848 | Medium | 4.1 | 2020-08-21 | An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided… |
CVE-2019-11853 | Low | 3.9 | 2020-08-21 | Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4. |
CVE-2019-11852 | Low | 3.7 | 2020-08-21 | An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACE… |
CVE-2019-11856 | Low | 3.3 | 2020-08-21 | A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView ser… |