CVE-2018-4064

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink ES450 FW version 4.9.3

Description The issue allows for an unverified password change through a specially crafted HTTP request to the upload.cgi functionality in ACEManager. This can result in an unauthorized change of the user password on the device. An attacker can exploit this by making an authenticated HTTP request.

Recommendations For Sierra Wireless AirLink ES450 FW version 4.9.3, consider restricting access to the upload.cgi functionality in ACEManager until a fix is available. As a temporary workaround, monitor device configuration changes closely to detect any unauthorized password changes.