CRITICAL🇵🇱 Wersja polska

CVE-2018-10251

CVSS 9.8v3.0pub. 2018-05-04upd. 2024-11-21

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Sierrawireless Aleos
OS
Sierrawireless
< 4.9.3< 4.4.7
Sierrawireless Es440
HW
Sierrawireless
all versions
Sierrawireless Es450
HW
Sierrawireless
all versions
Sierrawireless Gx400
HW
Sierrawireless
all versions
Sierrawireless Gx440
HW
Sierrawireless
all versions
Sierrawireless Gx450
HW
Sierrawireless
all versions
Sierrawireless Ls300
HW
Sierrawireless
all versions
Sierrawireless Mp70
HW
Sierrawireless
all versions
Sierrawireless Mp70e
HW
Sierrawireless
all versions
Sierrawireless Rv50
HW
Sierrawireless
all versions
Sierrawireless Rv50x
HW
Sierrawireless
all versions

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

Tags

RCE

CWE

References

source.sierrawireless.com/resources/airlink/software_re…

source.sierrawireless.com/resources/airlink/software_re…

Related vulnerabilities

CVE-2019-11851CRITICAL9.8PL ✓same product

Buffer overflow w usłudze ACENet Sierra Wireless ALEOS umożliwia RCE

CVE-2019-11857CRITICAL9.1PL ✓same product

Brak sanityzacji danych wejściowych w AceManager — Sierra Wireless ALEOS

CVE-2018-4063HIGH8.8⚠ KEVsame product

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless A...

CVE-2023-38321HIGH7.5same product

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to caus...

CVE-2023-40459HIGH7.5same product

The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization dur...