Lucene search

[email protected]NVD:CVE-2019-11848

HistoryAug 21, 2020 - 7:15 p.m.

CVE-2019-11848

2020-08-2119:15:11

CWE-787

[email protected]

web.nvd.nist.gov

api

aleos

vulnerability

length checking

user-provided values

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

45.2%

JSON

An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.

Affected configurations

Nvd

Node

sierrawirelessairlink_lx40Match-

sierrawirelessairlink_lx60Match-

sierrawirelessairlink_mp70Match-

sierrawirelessairlink_mp70eMatch-

sierrawirelessairlink_rv50Match-

sierrawirelessairlink_rv50xMatch-

AND

sierrawirelessaleosRange<4.13.0

Node

sierrawirelessairlink_es450Match-

sierrawirelessairlink_gx450Match-

AND

sierrawirelessaleosRange<4.9.5

Node

sierrawirelessairlink_es440Match-

sierrawirelessairlink_gx400Match-

sierrawirelessairlink_gx440Match-

sierrawirelessairlink_ls300Match-

AND

sierrawirelessaleosRange<4.4.9

VendorProductVersionCPE
sierrawirelessairlink_lx40-cpe:2.3:h:sierrawireless:airlink_lx40:-:*:*:*:*:*:*:*
sierrawirelessairlink_lx60-cpe:2.3:h:sierrawireless:airlink_lx60:-:*:*:*:*:*:*:*
sierrawirelessairlink_mp70-cpe:2.3:h:sierrawireless:airlink_mp70:-:*:*:*:*:*:*:*
sierrawirelessairlink_mp70e-cpe:2.3:h:sierrawireless:airlink_mp70e:-:*:*:*:*:*:*:*
sierrawirelessairlink_rv50-cpe:2.3:h:sierrawireless:airlink_rv50:-:*:*:*:*:*:*:*
sierrawirelessairlink_rv50x-cpe:2.3:h:sierrawireless:airlink_rv50x:-:*:*:*:*:*:*:*
sierrawirelessaleos*cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*
sierrawirelessairlink_es450-cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:*
sierrawirelessairlink_gx450-cpe:2.3:h:sierrawireless:airlink_gx450:-:*:*:*:*:*:*:*
sierrawirelessairlink_es440-cpe:2.3:h:sierrawireless:airlink_es440:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sierrawireless	airlink_lx40	-	cpe:2.3:h:sierrawireless:airlink_lx40:-:::::::*
sierrawireless	airlink_lx60	-	cpe:2.3:h:sierrawireless:airlink_lx60:-:::::::*
sierrawireless	airlink_mp70	-	cpe:2.3:h:sierrawireless:airlink_mp70:-:::::::*
sierrawireless	airlink_mp70e	-	cpe:2.3:h:sierrawireless:airlink_mp70e:-:::::::*
sierrawireless	airlink_rv50	-	cpe:2.3:h:sierrawireless:airlink_rv50:-:::::::*
sierrawireless	airlink_rv50x	-	cpe:2.3:h:sierrawireless:airlink_rv50x:-:::::::*
sierrawireless	aleos	*	cpe:2.3:o:sierrawireless:aleos::::::::
sierrawireless	airlink_es450	-	cpe:2.3:h:sierrawireless:airlink_es450:-:::::::*
sierrawireless	airlink_gx450	-	cpe:2.3:h:sierrawireless:airlink_gx450:-:::::::*
sierrawireless	airlink_es440	-	cpe:2.3:h:sierrawireless:airlink_es440:-:::::::*

Rows per page:

1-10 of 131

References

source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

45.2%

JSON

Related for NVD:CVE-2019-11848

cve1 cvelist1 prion1