CVE-2018-4063

Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

공격에 악용됨 높음 8.8 공격 가능성: 27%

무엇인가

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CISA: Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

할 일

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

미국 연방 기관 조치 기한: 2026년 1월 2일

CISA 목록에 추가됨: 2025년 12월 12일
게시됨: 2019년 5월 6일
심각도: 높음 8.8 CVSS 3.1
향후 30일 내 공격 가능성(EPSS): 27% 알려진 모든 취약점 중 상위 2.0%
약점 유형: CWE-434
자세히: NVD · CVE.org · CISA

모든 참고 자료(4)

출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.