Sierra Wireless AirLink Router with ALEOS Software

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sierra Wireless Equipment: AirLink Router with ALEOS Software Vulnerabilities: Improper Neutralization of Argument Delimiters in a Command, Exposure of Sensitive Information to an Unauthorized Actor 2...

ALEOS Buffer Overflow Vulnerability (CNVD-2020-48634)

ALEOS is an integrated development environment for building customized embedded M2M applications. A buffer overflow vulnerability exists in the AceManager Web API in ALEOS versions prior to 4.13.0, 4.9.5, and 4.4.9, and no details of the vulnerability are available at this time...

ALEOS Information Disclosure Vulnerability

ALEOS is an integrated development environment for building customized embedded M2M applications. An information disclosure vulnerability exists in ALEOS versions prior to 4.12.0, 4.9.5, and 4.4.9, which stems from a lack of input validation in ALEOS' AceManager, and can be exploited by an attack...

CVE-2019-11858

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

CVE-2019-11857

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

CVE-2019-11858

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

Buffer overflow

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

Design/Logic Flaw

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

CVE-2019-11858

CVE-2019-11858 involves multiple buffer overflow vulnerabilities in the AceManager Web API of the ALEOS platform. Connected sources indicate the affected software is ALEOS with vulnerable AceManager Web API versions prior to 4.13.0 , 4.9.5 , and 4.4.9 . The root cause is described as buffer overf...

CVE-2019-11858 ALEOS Multiple Web UI vulnerabilities

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

CVE-2019-11857 ALEOS AceManager Information Disclosure

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

CVE-2019-11857

The CVE-2019-11857 entry concerns ALEOS ACEOS AceManager prior to versions 4.12.0, 4.9.5, and 4.4.9. The root cause is lack of input sanitization/validation in AceManager, leading to disclosure of sensitive system information. The vulnerability affects ACEOS/ALEOS components handling input in Ace...

PT-2020-9219

Name of the Vulnerable Software and Affected Versions ALEOS versions prior to 4.13.0 ALEOS versions prior to 4.9.5 ALEOS versions prior to 4.4.9 Description Multiple buffer overflow vulnerabilities exist in the AceManager Web API. Recommendations For versions prior to 4.13.0, update to version...

PT-2020-9218

Name of the Vulnerable Software and Affected Versions ALEOS versions prior to 4.12.0 ALEOS versions prior to 4.9.5 ALEOS versions prior to 4.4.9 Description The issue is related to a lack of input sanitization in AceManager, which allows for the disclosure of sensitive system information...

CVE-2019-11857: Improper Input Validation

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

CVE-2019-11858: Buffer Copy without Checking Size of Input

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

CVE-2018-4064

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...

CVE-2018-4064: Improper Authentication

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...

PT-2019-10791

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3 Description The issue allows for an unverified password change through a specially crafted HTTP request to the upload.cgi functionality in ACEManager. This can result in an unauthorized change of...

CVE-2018-4072

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSetTask.cgi executable is used to change MSCII configuration values within the configuration manager of the AirLink ES450. Thi...