CISA Adds Actively Exploited Sierra Wireless Router Flaw Enabling RCE Attacks

Summary: CISA added CVE-2018-4063, an unrestricted file upload flaw in Sierra Wireless AirLink ALEOS routers rated 8.8/9.9, to its Known Exploited Vulnerabilities catalog on Friday after reports of active exploitation. The vulnerability, detailed by Cisco Talos in April 2019 and reported to Sierra Wireless in December 2018, lets an authenticated attacker upload a file with the same name as an existing executable file to the /cgi-bin/upload.cgi endpoint, and because ACEManager runs as root, uploaded code executes with elevated privileges.
What you should know: Forescout's Vedere Labs tied exploitation to a threat cluster named Chaya_005, which used the flaw in early January 2024 to upload a payload named fw_upload_init.cgi, and FCEB agencies have until January 2, 2026 to update or discontinue the end-of-support product.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2018-4063
Related: CVE-2018-4063: Sierra Wireless Air Link ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability Known Exploited Vulnerabilities · Dec 12, 2025
Vulnerability Spotlight: Multiple vulnerabilities in Sierra Wireless Air Link ES450 Cyber Risks ·
New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026