CVE-2020-8782: ALEOS LAN-Side RPC Service Remote Code Execution
Published Oct 6, 2020
·Updated
Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.
Affected Software
16 affected components
Sierrawireless Aleos<4.4.9
Sierrawireless Aleos>=4.5.0<4.9.5
Sierrawireless Aleos>=4.10.0<4.14.0
Sierrawireless Airlink Es440
Sierrawireless Airlink Es450
Sierrawireless Airlink Gx400
Sierrawireless Airlink Gx440
Sierrawireless Airlink Gx450
Sierrawireless Airlink Ls300
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
Sierrawireless Airlink Rv50x
Sierrawireless Airlink Rv55
Event History
Oct 6, 2020
CVE Published
via MITRE·01:54 PM
Data Sourced
via MITRE·01:54 PM
DescriptionSeverity
Frequently Asked Questions
1
What is CVE-2020-8782?
CVE-2020-8782 is a vulnerability that allows remote code execution on ALEOS versions before 4.4.9, 4.9.5, and 4.14.0.
2
How severe is CVE-2020-8782?
CVE-2020-8782 has a severity rating of 9.8, which is classified as critical.
3
Which software versions are affected by CVE-2020-8782?
ALEOS versions before 4.4.9, 4.9.5, and 4.14.0 are affected by CVE-2020-8782.
4
How can I fix CVE-2020-8782?
To fix CVE-2020-8782, it is recommended to upgrade to ALEOS version 4.4.9 or later.
5
Where can I find more information about CVE-2020-8782?
You can find more information about CVE-2020-8782 in the Sierra Wireless Technical Bulletin - SWI-PSA-2020-005.