Aleos Firmware Security Vulnerabilities - February

CVE-2016-5065

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.

CVE-2016-5066

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.

CVE-2016-5067

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.

CVE-2016-5068

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.

CVE-2016-5069

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.

CVE-2016-5070

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext.

CVE-2016-5071

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.