PT-2019-10798
CVE-2018-4071
·
تاريخ النشر
2019-05-06
·
تاريخ التحديث
2019-05-08
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Sierra Wireless AirLink ES450 FW version 4.9.3
Description
An Information Disclosure issue exists in the ACEManager EmbeddedAceGet Task.cgi functionality. The EmbeddedAceTLGet Task.cgi executable is used to retrieve MSCII configuration values within the configuration manager. This binary lacks restricted configuration settings, allowing any authenticated user to send configuration changes using the "/cgi-bin/Embedded Ace TLGet Task.cgi" endpoint.
Recommendations
For Sierra Wireless AirLink ES450 FW version 4.9.3, consider restricting access to the "/cgi-bin/Embedded Ace TLGet Task.cgi" endpoint to prevent unauthorized configuration changes until a fix is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾