CVE-2018-4072
First published: Mon May 06 2019(Updated: )
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSet_Task.cgi executable is used to change MSCII configuration values within the configuration manager of the AirLink ES450. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Set_Task.cgi endpoint.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sierrawireless Airlink Es450 Firmware | =4.9.3 | |
| Sierrawireless Airlink Es450 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2018-4072?
CVE-2018-4072 is a Permission Assignment vulnerability in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3.
What is the severity of CVE-2018-4072?
The severity of CVE-2018-4072 is high with a CVSS score of 8.8.
What is the affected software and version for CVE-2018-4072?
The affected software is Sierra Wireless AirLink ES450 FW 4.9.3.
How can the CVE-2018-4072 vulnerability be exploited?
The CVE-2018-4072 vulnerability can be exploited through the ACEManager EmbeddedAceSet_Task.cgi functionality.
Is Sierra Wireless AirLink ES450 vulnerable to CVE-2018-4072?
Sierra Wireless AirLink ES450 FW 4.9.3 is vulnerable to CVE-2018-4072.
How can I fix CVE-2018-4072?
To fix CVE-2018-4072, update to a version of Sierra Wireless AirLink ES450 firmware that is not affected by the vulnerability.
Where can I find more information about CVE-2018-4072?
You can find more information about CVE-2018-4072 at the following link: [https://talosintelligence.com/vulnerability_reports/TALOS-2018-0756](https://talosintelligence.com/vulnerability_reports/TALOS-2018-0756).
What is the CWE ID for CVE-2018-4072?
The CWE ID for CVE-2018-4072 is 732.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/tags
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/sierrawireless
- canonical/sierrawireless airlink es450 firmware
- version/sierrawireless airlink es450 firmware/4.9.3
- canonical/sierrawireless airlink es450