An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all…

Published 9 y ago 2017-06-30 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

4.3%

percentile 91%

Public exploits

none known

An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Several files and directories can be accessed without authentication, which may allow a remote attacker to perform sensitive functions including arbitrary file upload, file download, and device reboot.

Exploit prediction (EPSS)

4.26% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	10.0	`AV:N/AC:L/Au:N/C:C/I:C/A:C`

Affected products

n/a Sierra Wireless AirLink Raven XE and XT

Classification

Weakness

CWE-285 Improper Authorization
CWE-306 Missing Authentication for Critical Functionality

References

ics-cert.us-cert.gov /advisories/ICSA-17-115-02 · x_refsource_MISC, x_transferred
securityfocus.com /bid/98036 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2017-6044
NVD: CVE-2017-6044

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.