Latest Sierrawireless Vulnerabilities

● CVE-2023-38321
OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) ...
Sierrawireless Aleos<4.17.0.12
Sierrawireless Lx40
Sierrawireless Lx60
Sierrawireless Mp70
Sierrawireless Rv50x
Sierrawireless Rv55
● CVE-2023-40465
Improper input leads to DoS
Sierrawireless Aleos<=4.16.0
Sierrawireless Es450
Sierrawireless Gx450
Sierrawireless Lx40
Sierrawireless Lx60
Sierrawireless Mp70
and 2 more
● CVE-2023-40464
Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items could potentially perform a man in the middle...
Sierrawireless Aleos<=4.16.0
Sierrawireless Es450
Sierrawireless Gx450
Sierrawireless Lx40
Sierrawireless Lx60
Sierrawireless Mp70
and 2 more
● CVE-2023-40463
Use of Hard-Coded Credentials
Sierrawireless Aleos<=4.16.0
Sierrawireless Es450
Sierrawireless Gx450
Sierrawireless Lx40
Sierrawireless Lx60
Sierrawireless Mp70
and 2 more
● CVE-2023-40462
Improper input leads to DoS
Sierra OT/IoT routers
Sierra Wireless AirLink cellular routers
OpenNDS open Network Demarcation Service
Sierrawireless Aleos<=4.16.0
Sierrawireless Es450
and 7 more
● CVE-2023-40461
Cross-site scripting vulnerability in ACEManager
Sierrawireless Aleos<=4.16.0
Sierrawireless Es450
Sierrawireless Gx450
Sierrawireless Lx40
Sierrawireless Lx60
Sierrawireless Mp70
and 2 more
● CVE-2023-40460
Improper input leads to DoS
Sierrawireless Aleos<=4.16.0
Sierrawireless Es450
Sierrawireless Gx450
Sierrawireless Lx40
Sierrawireless Lx60
Sierrawireless Mp70
and 2 more
● CVE-2023-40459
Improper input leads to DoS
Sierrawireless Aleos<=4.16.0
Sierrawireless Es450
Sierrawireless Gx450
Sierrawireless Lx40
Sierrawireless Lx60
Sierrawireless Mp70
and 2 more
● CVE-2022-46650
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page.
Sierrawireless Aleos<=4.9.7
Sierrawireless Es450
Sierrawireless Gx450
Sierrawireless Aleos<=4.16.0
Sierrawireless Lx40
Sierrawireless Lx60
and 4 more
● CVE-2022-46649
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device.
Sierrawireless Aleos<=4.9.7
Sierrawireless Es450
Sierrawireless Gx450
Sierrawireless Aleos<=4.16.0
Sierrawireless Lx40
Sierrawireless Lx60
and 4 more
● CVE-2019-11851
The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overf...
Sierrawireless Aleos>=4.10.0<4.14.0
Sierrawireless Lx40
Sierrawireless Lx60
Sierrawireless Mp70
Sierrawireless Mp70e
Sierrawireless Rv50
and 9 more
● CVE-2019-13988
Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing).
Sierrawireless Mgos<4.3
Sierrawireless Airlink Mg90
Sierrawireless Mgos<3.15.2
Sierrawireless Airlink Omg2000
● CVE-2020-11101
Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login session with administrator privileges.
Sierrawireless Airlink Mobility Manager<2.17
● CVE-2020-8782
Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.
Sierrawireless Aleos<4.4.9
Sierrawireless Aleos>=4.5.0<4.9.5
Sierrawireless Aleos>=4.10.0<4.14.0
Sierrawireless Airlink Es440
Sierrawireless Airlink Es450
Sierrawireless Airlink Gx400
and 10 more
● CVE-2020-8781
Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process.
Sierrawireless Aleos>=4.11.0<4.14.0
Sierrawireless Airlink Es440
Sierrawireless Airlink Es450
Sierrawireless Airlink Gx400
Sierrawireless Airlink Gx440
Sierrawireless Airlink Gx450
and 8 more
● CVE-2019-11862
The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.
Sierrawireless Aleos<4.4.9
Sierrawireless Aleos>=4.9.0<4.9.5
Sierrawireless Airlink Es440
Sierrawireless Airlink Es450
Sierrawireless Airlink Gx400
Sierrawireless Airlink Gx440
and 8 more
● CVE-2019-11859
A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root.
Sierrawireless Aleos<=4.12.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 9 more
● CVE-2019-11847
Sierrawireless Aleos<4.11.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 9 more
● CVE-2019-11852
An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACEviewservice, accessible by default on the...
Sierrawireless Aleos<4.13.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 9 more
● CVE-2019-11855
An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9.
Sierrawireless Aleos<4.12.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 9 more
● CVE-2019-11853
Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4.
Sierrawireless Aleos<4.11.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 4 more
● CVE-2019-11857
Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information.
Sierrawireless Aleos<4.12.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 9 more
● CVE-2019-11856
A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sh...
Sierrawireless Aleos<=4.12.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 9 more
● CVE-2019-11850
A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution
Sierrawireless Aleos<4.11.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 1 more
● CVE-2019-11848
An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.
Sierrawireless Aleos<4.13.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 9 more
● CVE-2019-11858
Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9.
Sierrawireless Aleos<=4.12.0
Sierrawireless Airlink Lx40
Sierrawireless Airlink Lx60
Sierrawireless Airlink Mp70
Sierrawireless Airlink Mp70e
Sierrawireless Airlink Rv50
and 9 more
● CVE-2020-8948
The Sierra Wireless Windows Mobile Broadband Driver Packages (MBDP) before build 5043 allows an unprivileged user to overwrite arbitrary files in arbitrary folders using hard links. An unprivileged us...
Sierrawireless Mobile Broadband Driver Package<5043
● CVE-2018-4064
An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unveri...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4072
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSet_Task.cgi executable is u...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4073
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the endpoint /cgi-bin/Embede...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4070
An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. This binary does not have any restricted c...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4063
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in ex...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4062
A hard-coded credentials vulnerability exists in the snmpd function of the Sierra Wireless AirLink ES450 FW 4.9.3. Activating snmpd outside of the WebUI can cause the activation of the hard-coded cred...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4065
An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause refl...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4071
An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceTLGet_Task.cgi executable i...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4069
An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authentication functionality is done in plaintex...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4061
An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can inject arbitrary com...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450
● CVE-2018-4068
An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A HTTP request can result in disclosure of the default configurati...
Sierrawireless Airlink Es450 Firmware=4.9.3
Sierrawireless Airlink Es450

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203