CVE-2018-4072

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3

published May 6, 2019

CVSS
—
EPSS
26%
Percentile
98.0
In the wild
Unconfirmed
What it is

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSet_Task.cgi executable is used to change MSCII configuration values within the configuration manager of the AirLink ES450. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Set_Task.cgi endpoint.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.26431 · 98.0th percentile
Published
2019-05-06T18:21Z
EPSS history
Timeline
  • 22 SEP 03:16Z
    EPSS moved 26% → 15%
    epss
  • 06 SEP 03:12Z
    EPSS moved 26% → 15%
    epss
  • 30 AUG 16:01Z
    EPSS moved 15% → 26%
    epss
  • 29 AUG 04:40Z
    EPSS moved 27% → 15%
    epss
  • 06 MAY 18:21Z
    An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3
    cvelistv5