HIGH🇵🇱 Wersja polska

CVE-2015-2897

CVSS 10.0v2.0pub. 2015-08-08upd. 2026-05-06

Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (1) SSH or (2) TELNET session.

CVSS Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Sierrawireless Airlink Es440

    HW
    Sierrawireless
    all versions

  • Sierrawireless Airlink Es450

    HW
    Sierrawireless
    all versions

  • Sierrawireless Airlink Gx440

    HW
    Sierrawireless
    all versions

  • Sierrawireless Airlink Gx450

    HW
    Sierrawireless
    all versions

  • Sierrawireless Airlink Ls300

    HW
    Sierrawireless
    all versions

  • Sierrawireless Aleos

    APP
    Sierrawireless
    ≤ 4.4.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2019-11851CRITICAL9.8PL ✓same product

Buffer overflow w usłudze ACENet Sierra Wireless ALEOS umożliwia RCE

CVE-2019-11857CRITICAL9.1PL ✓same product

Brak sanityzacji danych wejściowych w AceManager — Sierra Wireless ALEOS

CVE-2018-10251CRITICAL9.8PL ✓same product

RCE w routerach Sierra Wireless AirLink — wykonanie kodu z uprawnieniami root

CVE-2018-4063HIGH8.8⚠ KEVsame product

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless A...

CVE-2023-38321HIGH7.5same product

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to caus...