MSRXVulnerabilities / CVE-2018-4063
CVE-2018-4063
Published 2019-05-06 · published (not yet in NVD)
CVE-2018-4063
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-12-12, with a fix-by date of 2026-01-02. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
8.8 HIGH
CVSS 3.1 · CNA
CVSS 3.1 · CNA
27%
chance of exploitation in the next 30 days (EPSS; higher than 98% of CVEs)
chance of exploitation in the next 30 days (EPSS; higher than 98% of CVEs)
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Scores
Affected products
- n/a Sierra Wireless: Sierra Wireless AirLink ES450 FW 4.9.3
4 references (advisories, patches, write-ups)
- http://packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html · x_refsource_MISC
- https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03 · x_refsource_MISC
- http://www.securityfocus.com/bid/108147 · vdb-entry, x_refsource_BID
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0748 · x_refsource_MISC
Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.