Lucene search

TalosCVE-2018-4069

HistoryMay 06, 2019 - 6:29 p.m.

CVE-2018-4069

2019-05-0618:29:00

CWE-200

talos

web.nvd.nist.gov

cve-2018-4069

information disclosure

vulnerability

acemanager

sierra wireless

airlink es450

plaintext xml

authentication

network traffic interception

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

59.7%

JSON

An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authentication functionality is done in plaintext XML to the web server. An attacker can listen to network traffic upstream from the device to capitalize on this vulnerability.

Affected configurations

Nvd

Vulners

Node

sierrawirelessairlink_es450_firmwareMatch4.9.3

AND

sierrawirelessairlink_es450Match-

VendorProductVersionCPE
sierrawirelessairlink_es450_firmware4.9.3cpe:2.3:o:sierrawireless:airlink_es450_firmware:4.9.3:*:*:*:*:*:*:*
sierrawirelessairlink_es450-cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sierrawireless	airlink_es450_firmware	4.9.3	cpe:2.3:o:sierrawireless:airlink_es450_firmware:4.9.3:::::::*
sierrawireless	airlink_es450	-	cpe:2.3:h:sierrawireless:airlink_es450:-:::::::*

CNA Affected

[
  {
    "product": "Sierra Wireless",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Sierra Wireless AirLink ES450 FW 4.9.3"
      }
    ]
  }
]