Vulnerability CVE-2018-4070

Vulnerability CVE-2018-4070

Published: 2019-05-06

Description:

An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Get_Task.cgi endpoint.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Sierra Wireless AirLink ES450 ACEManager Embedded_Ace_Get_Task.cgi Information Disclosure	Cisco Talos	28.04.2019

Type:

CWE-200

(Information Exposure)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4/10	2.9/10	8/10

Exploit range	Attack complexity	Authentication
Remote	Low	Single time
Confidentiality impact	Integrity impact	Availability impact
Partial	None	None

Affected software
Sierrawireless -> Airlink es450 firmware

References:

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0755

Copyright 2024, cxsecurity.com