peter bassill · operator
$ cve CVE-2018-4063 JSON

CVE-2018-4063 KEV

8.8
HIGH · CVSS 3.1 · EPSS 27.1% (pctl 98)

Patch first

On CISA KEV — known exploited in the wild, due 2026-01-02.

Description

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Scoring

CVSS8.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS27.06% — more likely to be exploited than 98% of all CVEs
WeaknessCWE-434
On CISA KEVyes — remediate by 2026-01-02
Public exploitnone known
Published2019-05-06
Last modified2026-06-17

CISA KEV

NameSierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
Added2025-12-12
Due2026-01-02
Vendor / productSierra Wireless / AirLink ALEOS
Ransomware usenone reported

Affected (13)

VendorProduct
sierrawirelessairlink es440
sierrawirelessairlink es450
sierrawirelessairlink gx400
sierrawirelessairlink gx440
sierrawirelessairlink gx450
sierrawirelessairlink ls300
sierrawirelessairlink lx40
sierrawirelessairlink lx60
sierrawirelessairlink mp70
sierrawirelessairlink mp70e
sierrawirelessairlink rv50
sierrawirelessairlink rv50x
sierrawirelessaleos

References

→ the Explorer  ·  watch your stack  ·  NVD