CVE-2019-11848: ALEOS AT Command API Abuse
Published Aug 21, 2020
·Updated
An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.
Affected Software
15 affected components
Sierrawireless Aleos<4.13.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
Sierrawireless Airlink Rv50x
Sierrawireless Aleos<4.9.5
Sierrawireless Airlink Es450
Sierrawireless Airlink Gx450
Sierrawireless Aleos<4.4.9
Sierrawireless Airlink Es440
Sierrawireless Airlink Gx400
Sierrawireless Airlink Gx440
Sierrawireless Airlink Ls300
Event History
Aug 21, 2020
CVE Published
via MITRE·06:44 PM
Data Sourced
via MITRE·06:44 PM
DescriptionSeverity
Frequently Asked Questions
1
What is CVE-2019-11848?
CVE-2019-11848 is an API abuse vulnerability in the AT command API of ALEOS before version 4.13.0, 4.9.5, 4.4.9.
2
What is the severity of CVE-2019-11848?
The severity of CVE-2019-11848 is high with a severity value of 7.2.
3
Which software versions are affected by CVE-2019-11848?
ALEOS versions before 4.13.0, 4.9.5, and 4.4.9 are affected by CVE-2019-11848.
4
How does CVE-2019-11848 allow API abuse?
CVE-2019-11848 allows API abuse by not performing length checking when handling certain user-provided values.
5
Where can I find more information about CVE-2019-11848?
You can find more information about CVE-2019-11848 in the Sierra Wireless Technical Bulletin SWI-PSA-2020-004.