PT-2019-10793

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description A cross-site request forgery issue exists in the ACEManager functionality. This allows an attacker to trick an authenticated user into making unintended requests, potentially leading t...

PT-2019-10794

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description An exploitable information disclosure issue exists in the ACEManager template load.cgi functionality. A specially crafted HTTP request can cause an information leak, resulting in the...

PT-2019-10799

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description A Permission Assignment issue exists in the ACEManager EmbeddedAceSet Task.cgi functionality. The EmbeddedAceSet Task.cgi executable is used to change MSCII configuration values within...

PT-2019-10796

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description An information disclosure issue exists in the ACEManager authentication functionality. This functionality uses plaintext XML to communicate with the web server, allowing an attacker to...

PT-2019-10795

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description An information disclosure issue exists in the ACEManager functionality. It allows an attacker to send an unauthenticated HTTP request, potentially disclosing the default configuration...

PT-2019-10800

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description A Permission Assignment issue exists in the ACEManager EmbeddedAceSet Task.cgi functionality. The endpoint "/cgi-bin/Embeded Ace TLSet Task.cgi" allows for arbitrary setting writes,...

PT-2019-10797

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description An Information Disclosure issue exists in the ACEManager EmbeddedAceGet Task.cgi functionality. This allows any authenticated user to send configuration changes using the...

CVE-2018-4071: Exposure of Sensitive Information to an Unauthorized Actor

An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceTLGetTask.cgi executable is used to retrieve MSCII configuration values within the configuration manager of the AirLink ES450...

CVE-2018-4066: Cross-Site Request Forgery (CSRF)

An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause an authenticated user to perform privileged requests unknowingly, resulting in unauthenticated requests being...

Sierra Wireless AirLink ES450 ACEManager template_load.cgi Information Disclosure Exploit

An exploitable information disclosure vulnerability exists in the ACEManager templateload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a information leak, resulting in the disclosure of internal paths and files. An attacker can make an...

Sierra Wireless AirLink ES450 ACEManager Embedded_Ace_Get_Task.cgi Information Disclosure Exploit

An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause an information disclosure, resulting in the exposure of confidential information, including, but...

Sierra Wireless AirLink ES450 ACEManager Information Disclosure Exploit

An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A HTTP request can result in disclosure of the default configuration for the device. An attacker can send an unauthenticated HTTP request to trigger this...

Sierra Wireless AirLink ES450 ACEManager Information Exposure Exploit

An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authentication functionality is done in plaintext XML to the web server. An attacker can listen to network traffic upstream from the device to...

Sierra Wireless AirLink ES450 ACEManager iplogging.cgi Command Injection Exploit

An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can inject arbitrary commands, resulting in arbitrary command execution. An attacker can send an authenticated HTTP reque...

Sierra Wireless AirLink ES450 ACEManager ping_result.cgi Cross Site Scripting Vulnerability

An exploitable cross-site scripting vulnerability exists in the ACEManager pingresult.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code running on the...

Sierra #Wireless #AirLink ES450 #ACEManager upload.cgi Unverified Password Change Exploit

Exploit for hardware platform in category web applications...

Sierra Wireless AirLink ES450 ACEManager Embedded_Ace_Set_Task.cgi Permission Assignment Exploit

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a arbitrary setting writes, resulting in the unverified changes to any system setting. An attacker...

Sierra Wireless AirLink ES450 ACEManager upload.cgi Remote Code Execution Exploit

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticat...

Sierra Wireless AirLink ES450 ACEManager Cross Site Request Forgery Vulnerability

An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause an authenticated user to perform privileged requests unknowingly, resulting in unauthenticated requests being...

Sierra Wireless AirLink ES450 Information Disclosure Vulnerability (CNVD-2019-13407)

The Sierra Wireless AirLink ES450 is a cellular network modem device from Sierra Wireless Canada. An information disclosure vulnerability exists in the ACEManager EmbeddedAceGetTask.cgi function in the Sierra Wireless AirLink ES450 using firmware version 4.9.3. The vulnerability stems from an err...