8.8high
CVE-2018-4063KEVin critical feed
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.1 · CNA
CISA KEV
Yes
added 2025-12-12
EPSS
27.3%
percentile 98%
Public exploits
0
none known
Summary
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Known exploited (CISA KEV)
- Added
- 10 mo ago
- Due date
- 2026-01-02 (10 mo ago)
- Ransomware use
- Unknown
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Vendor / product
- Sierra Wireless / AirLink ALEOS
- CISA name
- Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction (EPSS)
27.26% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- n/a Sierra Wireless
Classification
- Weakness
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
- packetstormsecurity.com /files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.ht · x_refsource_MISC, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-19-122-03 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/108147 · vdb-entry, x_refsource_BID, x_transferred
- talosintelligence.com /vulnerability_reports/TALOS-2018-0748 · x_refsource_MISC, x_transferred
- forescout.com /blog/ot-network-security-threats-industrial-routers-under-attack/ · third-party-advisory
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4063 · government-resource
Sources
- CVE List: CVE-2018-4063
- NVD: CVE-2018-4063
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.