Sierra Wireless AirLink Router with ALEOS Software

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sierra Wireless Equipment: AirLink Router with ALEOS Software Vulnerabilities: Improper Neutralization of Argument Delimiters in a Command, Exposure of Sensitive Information to an Unauthorized Actor 2...

ALEOS Information Disclosure Vulnerability

ALEOS is an integrated development environment for building customized embedded M2M applications. An information disclosure vulnerability exists in ALEOS versions prior to 4.12.0, 4.9.5, and 4.4.9, which stems from a lack of input validation in ALEOS' AceManager, and can be exploited by an attack...

ALEOS Buffer Overflow Vulnerability (CNVD-2020-48634)

ALEOS is an integrated development environment for building customized embedded M2M applications. A buffer overflow vulnerability exists in the AceManager Web API in ALEOS versions prior to 4.13.0, 4.9.5, and 4.4.9, and no details of the vulnerability are available at this time...

CVE-2019-11858

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

CVE-2019-11857

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

CVE-2019-11858

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

Design/Logic Flaw

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

Buffer overflow

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

CVE-2019-11858 ALEOS Multiple Web UI vulnerabilities

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

CVE-2019-11858

CVE-2019-11858 involves multiple buffer overflow vulnerabilities in the AceManager Web API of the ALEOS platform. Connected sources indicate the affected software is ALEOS with vulnerable AceManager Web API versions prior to 4.13.0 , 4.9.5 , and 4.4.9 . The root cause is described as buffer overf...

CVE-2019-11857

The CVE-2019-11857 entry concerns ALEOS ACEOS AceManager prior to versions 4.12.0, 4.9.5, and 4.4.9. The root cause is lack of input sanitization/validation in AceManager, leading to disclosure of sensitive system information. The vulnerability affects ACEOS/ALEOS components handling input in Ace...

CVE-2019-11857 ALEOS AceManager Information Disclosure

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

CVE-2019-11857: Improper Input Validation

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

CVE-2019-11858: Buffer Copy without Checking Size of Input

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

CVE-2018-4064

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...

CVE-2018-4064: Improper Authentication

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...

CVE-2018-4072

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSetTask.cgi executable is used to change MSCII configuration values within the configuration manager of the AirLink ES450. Thi...

CVE-2018-4073

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the endpoint /cgi-bin/EmbededAceTLSetTask.cgi is a very similar endpoint that is designed for use with setting table values th...

CVE-2018-4071

An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceTLGetTask.cgi executable is used to retrieve MSCII configuration values within the configuration manager of the AirLink ES450...

Information disclosure

An exploitable information disclosure vulnerability exists in the ACEManager templateload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a information leak, resulting in the disclosure of internal paths and files. An attacker can make an...