Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless Air Link ES450

Summary: Cisco Talos disclosed multiple exploitable vulnerabilities in the Sierra Wireless AirLink ES450 LTE gateway, an LTE device used in distributed enterprise settings such as retail point-of-sale and industrial control systems, with most flaws residing in the ACEManager web server that handles device reconfiguration, user authentication and certificate management. Talos tested and confirmed version 4.9.3 is affected, and the flaws include command injection in iplogging.cgi (CVE-2018-4061), hard-coded SNMPD credentials (CVE-2018-4062), remote code execution via upload.cgi (CVE-2018-4063), an unverified password change (CVE-2018-4064), reflected cross-site scripting in ping_result.cgi (CVE-2018-4065), cross-site request forgery (CVE-2018-4066), and several information disclosure issues including plaintext XML authentication and exposure of plain text passwords and SNMP community strings.
Bottom line: These flaws sit in the gateway that anchors retail point-of-sale and industrial control networks, and one of them exposes plain text passwords and SNMP community strings to anyone listening on traffic upstream from the device.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-4061 CVE-2018-4062 CVE-2018-4063 CVE-2018-4064 CVE-2018-4065 CVE-2018-4066
Related: CVE-2018-4063: Sierra Wireless Air Link ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability Known Exploited Vulnerabilities · Dec 12, 2025
CISA Adds Actively Exploited Sierra Wireless Router Flaw Enabling RCE Attacks Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026